Stated version of the Global Privacy Statement: last updated August 31, 2026
The document states its own version date: last updated August 31, 2026. The Statement is one global text, not a United States-only notice: it names a United Kingdom and Canada address, EEA and UK transfer rules, and California, Nevada, France, Hong Kong, Türkiye, China, Brazil, Monaco, Nigeria, Korea, Mexico and Albania provisions, so this date versions the whole global statement.
Supporting quotations
Last updated: August 31, 2026
Qualifications & exceptions
This is the statement's own stated date; it is not a check of the publisher's live page.
The date versions the global statement, whose regional appendices carry their own terms.
Legal Rights & Agreement Rules · Company commitment
Hilton's mission, its privacy pledge, and what the Statement explains
Hilton states its mission to be the most hospitable company in the world and pledges to deliver the highest level of customer service, which includes respecting privacy and protecting personal information. It then explains the document's purpose: to give details of how Hilton collects, uses and discloses personal information. The document names itself the privacy statement and defines 'Statement' as the short form used for it throughout.
Supporting quotations
Hilton’s mission is to be the most hospitable company in the world.
We pledge to deliver the highest level of customer service, which includes respecting your privacy and protecting your personal information.
In this privacy statement (“Statement”), we provide you with details about how we collect, use, and disclose your personal information.
Qualifications & exceptions
The commitment is framed as part of a high level of customer service, not as a guarantee of absolute privacy or security.
The Statement is a global document; nothing in this passage limits it to United States users.
Legal Rights & Agreement Rules · Context
Entities the Statement applies to: Hilton Worldwide Holdings, its subsidiaries and all Portfolio brands
The Statement applies to Hilton Worldwide Holdings Inc., its subsidiaries, and all hotels within the Hilton Portfolio of Brands, which it then lists brand by brand, from Waldorf Astoria Hotels & Resorts and LXR Hotels & Resorts through Hampton by Hilton, Tru by Hilton, Spark by Hilton, Homewood Suites by Hilton, LivSmart Studios by Hilton, Graduate by Hilton, NoMad, Outset Collection by Hilton, Apartment Collection by Hilton, Select by Hilton and Undergraduate by Hilton. The covered population is therefore the whole global hotel group, not only Hilton's United States properties, and the scope follows the group rather than a single brand's United States terms.
Supporting quotations
This Statement applies to Hilton Worldwide Holdings Inc., its subsidiaries, and all of the hotels within the Hilton Portfolio of Brands
Our Portfolio of Brands includes Waldorf Astoria Hotels & Resorts, LXR Hotels & Resorts, Conrad Hotels & Resorts, Canopy by Hilton
Spark by Hilton, Homewood Suites by Hilton, Home2 Suites by Hilton, LivSmart Studios by Hilton, Graduate by Hilton, NoMad, Outset Collection by Hilton, Apartment Collection by Hilton, Select by Hilton, and Undergraduate by Hilton.
Qualifications & exceptions
Coverage follows the corporate group and the Portfolio of Brands worldwide, not a single country.
Franchised and joint-venture hotels in the Portfolio are covered by the Statement, though they may act as their own controllers.
Legal Rights & Agreement Rules · Permission or license
Using Hilton products or agreeing to the Statement acknowledges collection and use
Hilton says that by using any of its products or services, and/or by agreeing to this Statement — for example when registering for a product or service — the person understands and acknowledges that Hilton will collect and use personal information as described in the Statement. The acknowledgement is of collection and use on the terms described; where consent is required for other processing, the Statement separately says explicit, informed consent is obtained.
Supporting quotations
By using any of our products or services and/or by agreeing to this Statement, e.g., in the context of registering for any of our products or services, you understand and acknowledge that we will collect and use personal information as described in this Statement.
Qualifications & exceptions
The acknowledgement covers collection and use as described in the Statement, not every processing activity.
The Statement separately requires explicit, informed consent where consent is the applicable basis, including before selling or sharing.
Data Access & Collection · Restriction or exception
The Statement does not cover Hilton's processing for other companies
The Statement states that it does not apply to Hilton's processing of personal information on behalf of, and subject to the instructions of, third parties such as airlines, car rental companies and other service providers, companies that organize or offer packaged travel arrangements, marketing partners, or certain corporate customers. Where Hilton acts only as someone else's processor, the person's data is governed by that other company's own notice rather than by this text.
Supporting quotations
Please note that this Statement does not apply to our processing of personal information on behalf of and subject to the instructions of third parties such as airlines, car rental companies and other service providers, companies that organize or offer packaged travel arrangements, marketing partners, or certain corporate customers.
Qualifications & exceptions
The exclusion is limited to processing done on another party's instructions; Hilton's own collection and use remain covered.
The list of excluded controllers is given by example, not exhaustively.
Legal Rights & Agreement Rules · Company practice
Hilton Domestic Operating Company Inc. is the data controller for guest data
The Statement names Hilton Domestic Operating Company Inc., a United States corporation organized under Delaware law, as the Hilton entity that is the data controller for all guest data and that operates, among other things, Hilton's marketing activities. It is a subsidiary of Hilton Worldwide Holdings Inc. The controller named here is a United States entity, but the data it controls is guest data worldwide under this global statement.
Supporting quotations
Hilton Domestic Operating Company Inc., a corporation in the United States duly organized and existing under the laws of the State of Delaware, is the Hilton entity that is the data controller for all guest data
and operates, among other things, Hilton’s marketing activities
Hilton Domestic Operating Company Inc. is a subsidiary of Hilton Worldwide Holdings Inc.
Qualifications & exceptions
The controller is named for guest data as a whole; other group entities, and franchised or joint-venture hotels, may be controllers for their own data.
Marketing activities are operated by this entity but remain subject to the choices the Statement describes.
Legal Rights & Agreement Rules · Restriction or exception
Franchised and joint-venture hotels are separate entities and may be independent controllers
The Statement explains that the Portfolio of Brands includes managed, franchised and joint venture hotels; franchised hotels are operated by entities separate from Hilton, and joint venture hotels are operated by entities that are only partially owned or controlled by Hilton. Those entities, in addition to Hilton Domestic Operating Company Inc., may be independent data controllers for guest data, so the Statement's commitments are made by Hilton for Hilton's own processing rather than for every hotel's processing.
Supporting quotations
The Hilton Portfolio of Brands includes managed, franchised, and joint venture hotels.
Franchised hotels are operated by entities that are separate from Hilton.
In addition to Hilton Domestic Operating Company Inc., those entities may be independent data controllers for guest data.
Qualifications & exceptions
Only franchised and joint-venture hotels are described as possibly separate; managed hotels are not described here.
Separate control follows from the operating model, not from the guest's choice of hotel.
Data Access & Collection · Company practice
What the collection summary covers, the required-information limit, and the consent promise
Hilton introduces the collection summary by saying it covers the categories of personal information collected in the past 12 months, the sources of each category, the business or commercial purposes for collection, the categories of third parties the information may have been shared with as permitted by law, and whether it was sold to a third party for a business or commercial purpose in that period. It adds two limits: some categories are required in order to provide the requested products or services, so declining to give them may mean Hilton cannot provide those services; and where consent is required, Hilton will obtain explicit, informed consent before collecting, processing, selling or sharing.
Supporting quotations
The following summarizes the categories of personal information we have collected in the past 12 months, the sources for those categories of personal information, the business or commercial purposes for which the information was collected, the categories of third parties with whom the information may have been shared, as permitted by law, and whether the information was sold to a third party for a business or commercial purpose within the past 12 months.
Certain categories of personal information collected are required in order for us to provide you with the requested products or services, and if you choose not to provide us with such information, we may not be able to provide you with these products or services.
If consent is required, we will obtain your explicit, informed consent before collecting, processing, selling, or sharing your personal information.
For additional information on how we share personal information, please refer to the How We Disclose Personal Information section.
Qualifications & exceptions
The summary reports a 12-month look-back, so it is a retrospective disclosure rather than a complete description of every category Hilton may hold.
Refusal of required categories limits service delivery, not the rest of the relationship.
The consent promise is conditional on consent being required in the applicable jurisdiction.
Data Access & Collection · Company practice
Name: collected from the guest, from booking platforms and credit card providers, and from demographics companies
For the 'Name' category, Hilton states that it obtained the information from three sources: directly from consumers themselves; from third parties such as travel booking platforms and credit card providers; and from demographics companies. It then lists the business or commercial purposes for which the name was collected, beginning with fulfilling guest reservations; the rest of the listed purposes, and the third-party sharing and sale status for this category, are set out in the following part of the collection summary.
Supporting quotations
Name
We have obtained this personal information from the following sources:
Directly from consumers themselves
From third parties such as travel booking platforms and credit card providers
From demographics companies
We collected this personal information for the following business or commercial purposes:
Fulfill guest reservations
Qualifications & exceptions
The statement reports what was collected in the 12 months before August 31, 2026, not a guarantee about future collection.
Enrichment from demographics companies is described as a source of the name, without stating what that enrichment contains.
Use & Processing · Company practice
Name: business purposes Hilton says it collected the name for
The list of business or commercial purposes for collecting the name continues: sending guests communications about their reservations; administering membership and activity in the Hilton Honors loyalty program; providing customer service and support; verifying identity; sending marketing communications by email, direct mail and social media; performing analytics that provide guests with personalized offers and content, and analytics that improve business operations; determining guests' eligibility for special or promotional rates; processing payments, including strong customer authentication where the law requires it; processing transactions with partners; administering contests and sweepstakes; optimizing Hilton's websites and mobile apps; and detecting and preventing fraud. The name therefore serves the reservation and the account, but is also used for marketing, personalization and fraud prevention.
Supporting quotations
Send guests communications relating to their reservations
Administer membership and activity in the Hilton Honors loyalty program
Provide customer service and support
Verify identity
Send marketing communications via email, direct mail, and social media
Perform analytics to provide guests with personalized offers and content
Perform analytics to improve business operations
Determine guests’ eligibility for special or promotional rates
Process payments, including conducting strong customer authentication (SCA) when required by law
Process transactions with partners
Administer contests and sweepstakes
Optimize our websites and mobile apps
Detect and prevent fraud
Qualifications & exceptions
The purposes are stated as the reasons for collection during the 12 months before August 31, 2026.
Strong customer authentication is stated to apply only 'when required by law'.
Marketing by email, direct mail and social media is listed as a purpose of collecting the name, subject to the marketing choices described later in the Statement.
Sharing & Disclosure · Company practice
Name: third parties the name was shared with, and the sale statement
Hilton states that it shared the name with service providers who perform tasks on its behalf, which may include providers that send marketing communications on its behalf; with Hilton's Third-Party Partner; with payment card issuers and payment processors; with employers under corporate agreements, employee consent and as permitted by law; with entities that arranged a special rate plan, an event or a room block with Hilton; with the third-party travel booking platform or travel agent through which the guest made the reservation; with government agencies pursuant to legal requirements in some countries; with third-party advertisers, for optimization and personalization on their platforms; with Hilton's Third-Party Operator; and with Hilton Principal. The same line answers the sale question for this category: the information was sold to a third party within the past 12 months — Yes.
Supporting quotations
We have shared this personal information with the following categories of third parties
Service providers who perform tasks on behalf of Hilton, which may include those who send marketing communications on our behalf
Hilton’s Third-Party Partner
Payment card issuers and payment processors
Employers pursuant to corporate agreements, employee consent, and as permitted by law
Entities that have arranged a special rate plan with Hilton and/or organized an event and/or room block with Hilton
The third-party travel booking platform or travel agent through which a guest made a reservation
Government agencies pursuant to legal requirements in some countries
Third-party advertisers, for optimization and personalization on their platforms
Hilton's Third-Party Operator
Hilton Principal
This information was sold to a third party within the past 12 months Yes
Qualifications & exceptions
The sale answer covers the 12 months before the statement's August 31, 2026 date.
Recipients are named as categories of third party, not as named companies, apart from the Hilton-related roles the Statement defines later.
The service-provider category expressly includes providers that send marketing communications on Hilton's behalf.
Government sharing is qualified to 'some countries' and to legal requirements.
Data Access & Collection · Company practice
Telephone and fax numbers: sources and business purposes
For telephone and fax numbers, Hilton says it obtained the information directly from consumers themselves, from third parties such as travel booking platforms and credit card providers, and from demographics companies. The business or commercial purposes it lists for collecting telephone and fax numbers are: fulfilling guest reservations; sending guests communications about their reservations; providing customer service and support; verifying identity; sending marketing communications by SMS; processing transactions with partners; authenticating a mobile account; sending service-related SMS communications; detecting and preventing fraud; engaging in sales activity for group bookings, meetings and events; and sending post-stay surveys by SMS.
Supporting quotations
Telephone and fax numbers
We have obtained this personal information from the following sources:
Directly from consumers themselves
From third parties such as travel booking platforms and credit card providers
From demographics companies
We collected this personal information for the following business or commercial purposes:
Fulfill guest reservations
Send guests communications relating to their reservations
Provide customer service and support
Verify identity
Send marketing communications via SMS
Process transactions with partners
Authenticate mobile account
Sending service-related SMS communications
Detect and prevent fraud
Engage in sales activity for group bookings, meetings and events
Qualifications & exceptions
The stated collection window is the 12 months before August 31, 2026.
SMS marketing and post-stay surveys by SMS are stated purposes here; the Statement's marketing choices section governs how they can be stopped.
The French appendix states that the phone number is not used for telemarketing, which is a France-specific rule and not the rule of this main body.
Sharing & Disclosure · Company practice
Telephone and fax numbers: post-stay surveys, third-party sharing and the sale statement
The last stated purpose for telephone and fax numbers is sending post-stay surveys by SMS. Hilton then says it shared the number with service providers who perform tasks on its behalf, including providers that send marketing communications on its behalf; with Hilton's Third-Party Partner; with employers under corporate agreements, employee consent and as permitted by law; with the third-party travel booking platform or travel agent through which the guest booked; with third-party advertisers, for optimization and personalization on their platforms; with Hilton's Third-Party Operator; and with Hilton Principal. The sale answer for this category is Yes: the information was sold to a third party within the past 12 months.
Supporting quotations
Sending post-stay surveys via SMS
We have shared this personal information with the following categories of third parties
Service providers who perform tasks on behalf of Hilton, which may include those who send marketing communications on our behalf
Hilton's Third-Party Partner
Employers pursuant to corporate agreements, employee consent, and as permitted by law
The third-party travel booking platform or travel agent through which a guest made a reservation
Third-party advertisers, for optimization and personalization on their platforms
Hilton's Third-Party Operator
Hilton Principal
This information was sold to a third party within the past 12 months
Yes
Qualifications & exceptions
The sale answer covers the 12 months before August 31, 2026.
Recipients are categories of third party, not named companies.
No government-agency recipient is listed for this category, unlike the name and nationality categories.
Data Access & Collection · Company practice
Email address: sources and business purposes
For email addresses, Hilton says it obtained the information directly from consumers themselves, from third parties such as travel booking platforms and credit card providers, and from demographics companies. The purposes it lists are: fulfilling guest reservations; sending guests communications about their reservations; administering membership and activity in the Hilton Honors loyalty program; providing customer service and support; verifying identity; sending marketing communications by email; processing transactions with partners; administering contests and sweepstakes; authenticating a mobile account; detecting and preventing fraud; and engaging in sales activity for group bookings, meetings and events.
Supporting quotations
Email address
We have obtained this personal information from the following sources:
Directly from consumers themselves
From third parties such as travel booking platforms and credit card providers
From demographics companies
We collected this personal information for the following business or commercial purposes:
Fulfill guest reservations
Send guests communications relating to their reservations
Administer membership and activity in the Hilton Honors loyalty program
Provide customer service and support
Verify identity
Send marketing communications via email
Process transactions with partners
Administer contests and sweepstakes
Authenticate mobile account
Detect and prevent fraud
Qualifications & exceptions
The stated collection window is the 12 months before August 31, 2026.
Email marketing is listed as a purpose here, subject to the marketing choices and unsubscribe rights the Statement describes.
The source list shows the email address can be obtained indirectly from booking platforms, card providers and demographics companies.
Sharing & Disclosure · Company practice
Email address: group sales purpose, third-party sharing and the sale statement
The remaining stated purpose for email addresses is engaging in sales activity for group bookings, meetings and events. Hilton says it shared the email address with service providers performing tasks on its behalf, including providers that send marketing communications on its behalf; with Hilton's Third-Party Partner; with employers under corporate agreements, employee consent and as permitted by law; with the third-party travel booking platform or travel agent through which the guest booked; with third-party advertisers, for optimization and personalization on their platforms; with Hilton's Third-Party Operator; and with Hilton Principal. The sale answer for this category is Yes: the information was sold to a third party within the past 12 months.
Supporting quotations
Engage in sales activity for group bookings, meetings and events
We have shared this personal information with the following categories of third parties
Service providers who perform tasks on behalf of Hilton, which may include those who send marketing communications on our behalf
Hilton's Third-Party Partner
Employers pursuant to corporate agreements, employee consent, and as permitted by law
The third-party travel booking platform or travel agent through which a guest made a reservation
Third-party advertisers, for optimization and personalization on their platforms
Hilton's Third-Party Operator
Hilton Principal
This information was sold to a third party within the past 12 months
Yes
Qualifications & exceptions
The sale answer covers the 12 months before August 31, 2026.
Recipients are categories of third party, not named companies.
The third-party advertisers entry is qualified to optimization and personalization on their own platforms.
Data Access & Collection · Company practice
Home address: obtained directly from consumers
For home address, the collection summary opens by naming its sources: Hilton obtained the information directly from consumers themselves, and lists further sources and purposes for the same category further on. A home address is therefore collected from the guest as a primary source, with the remaining sources, the business purposes and the third-party sharing for this category stated in the following part of the summary.
Supporting quotations
Home address
We have obtained this personal information from the following sources:
Directly from consumers themselves
Qualifications & exceptions
Only the first source of this category is stated in this part; the rest of the category is set out in the next part of the summary.
The category is 'Home address' as such; a separate 'Address' category with its own sources, purposes and sharing appears in the point-of-collection section.
Data Access & Collection · Company practice
Home address: further sources — booking platforms, card providers and demographics companies
Beyond the guest directly, Hilton says it obtained the home address from third parties such as travel booking platforms and credit card providers, and from demographics companies. The address can therefore be collected indirectly from booking and payment channels and enriched from demographic data providers, not only typed in by the guest.
Supporting quotations
From third parties such as travel booking platforms and credit card providers
From demographics companies
Qualifications & exceptions
The stated collection window is the 12 months before August 31, 2026.
The Statement does not say which fields are received from these sources.
Use & Processing · Company practice
Home address: business purposes Hilton says it collected the address for
Hilton lists these business or commercial purposes for the home address: fulfilling guest reservations; sending guests communications about their reservations; administering membership and activity in the Hilton Honors loyalty program; providing customer service and support; verifying identity; sending marketing communications by direct mail; performing analytics that provide guests with personalized offers and content, and analytics that improve business operations; processing payments, including strong customer authentication where the law requires it; processing transactions with partners; administering contests and sweepstakes; detecting and preventing fraud; and engaging in sales activity for group bookings, meetings and events. A street address is therefore used for service delivery, payments and analytics as well as for direct-mail marketing.
Supporting quotations
We collected this personal information for the following business or commercial purposes:
Fulfill guest reservations
Administer membership and activity in the Hilton Honors loyalty program
Provide customer service and support
Verify identity
Send marketing communications via direct mail
Perform analytics to provide guests with personalized offers and content
Perform analytics to improve business operations
Process payments, including conducting strong customer authentication (SCA) when required by law
Process transactions with partners
Administer contests and sweepstakes
Detect and prevent fraud
Engage in sales activity for group bookings, meetings and events
Qualifications & exceptions
The purposes cover the 12 months before August 31, 2026.
Strong customer authentication is stated to apply only 'when required by law'.
Direct-mail marketing is a stated purpose here, subject to the marketing choices and rights the Statement sets out later.
Sharing & Disclosure · Company practice
Home address: third parties the address was shared with, and the sale statement
Hilton states that it shared the home address with service providers who perform tasks on its behalf; with Hilton's Third-Party Partner; with payment card issuers and payment processors; with employers under corporate agreements, employee consent and as permitted by law; with the third-party travel booking platform or travel agent through which the guest booked; with third-party advertisers, for optimization and personalization on their platforms; with Hilton's Third-Party Operator; and with Hilton Principal. The sale answer for this category is Yes: the information was sold to a third party within the past 12 months.
Supporting quotations
We have shared this personal information with the following categories of third parties
Service providers who perform tasks on behalf of Hilton
Hilton's Third-Party Partner
Payment card issuers and payment processors
Employers pursuant to corporate agreements, employee consent, and as permitted by law
The third-party travel booking platform or travel agent through which a guest made a reservation
Third-party advertisers, for optimization and personalization on their platforms
Hilton's Third-Party Operator
Hilton Principal
This information was sold to a third party within the past 12 months
Yes
Qualifications & exceptions
The sale answer covers the 12 months before August 31, 2026.
Recipients are categories of third party rather than named companies.
Employer sharing is conditional on corporate agreements, employee consent and the law.
Data Access & Collection · Company practice
Nationality: collected from the guest for legal compliance, shared with government agencies, not sold
For nationality, Hilton says it obtained the information directly from consumers themselves and collected it to comply with applicable laws that require the collection of this information in some jurisdictions. It says it shared nationality with government agencies pursuant to legal requirements in some countries, and that the information was not sold to a third party within the past 12 months. The legal-trigger wording is global and qualified: the Statement does not tie the collection or the government sharing to United States law only.
Supporting quotations
Nationality
We have obtained this personal information from the following sources:
Directly from consumers themselves
We collected this personal information for the following business or commercial purposes:
Comply with applicable laws that require us to collect this information in some jurisdictions
We have shared this personal information with the following categories of third parties
Government agencies pursuant to legal requirements in some countries
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
Collection and government sharing are tied to laws and requirements 'in some jurisdictions' and 'in some countries', not to any one country.
The sale answer covers the 12 months before August 31, 2026.
Data Access & Collection · Company practice
Date of birth: collected from the guest for legal compliance, shared with government agencies, not sold
For date of birth, Hilton says it obtained the information directly from consumers themselves and collected it to comply with applicable laws that require the collection of this information in some jurisdictions. It says it shared the date of birth with government agencies pursuant to legal requirements in some countries, and that this information was not sold to a third party within the past 12 months.
Supporting quotations
Date of birth
We have obtained this personal information from the following sources:
Directly from consumers themselves
We collected this personal information for the following business or commercial purposes:
Comply with applicable laws that require us to collect this information in some jurisdictions
We have shared this personal information with the following categories of third parties
Government agencies pursuant to legal requirements in some countries
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
Collection and government sharing are qualified to laws and requirements 'in some jurisdictions' and 'in some countries'.
The sale answer covers the 12 months before August 31, 2026.
Data Access & Collection · Company practice
Gender: collected from the guest for legal compliance, shared with government agencies, not sold
For gender, Hilton says it obtained the information directly from consumers themselves and collected it to comply with applicable laws that require the collection of this information in some jurisdictions. It says it shared gender with government agencies pursuant to legal requirements in some countries, and that this information was not sold to a third party within the past 12 months. The Statement does not describe gender as used for personalization here; the stated purpose is legal compliance.
Supporting quotations
Gender
We have obtained this personal information from the following sources:
Directly from consumers themselves
We collected this personal information for the following business or commercial purposes:
Comply with applicable laws that require us to collect this information in some jurisdictions
We have shared this personal information with the following categories of third parties
Government agencies pursuant to legal requirements in some countries
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
Collection and government sharing are qualified to laws and requirements 'in some jurisdictions' and 'in some countries'.
The sale answer covers the 12 months before August 31, 2026.
Data Access & Collection · Company practice
Payment card information: sources, payment and record-keeping purposes, recipients, not sold
For payment card information, Hilton says it obtained the information directly from consumers themselves and from the third-party travel booking platform or travel agent through which a consumer made a reservation. The stated purposes are processing payments, including strong customer authentication where the law requires it, detecting and preventing fraud, and maintaining books and records to comply with legal obligations for business reporting, auditing, tax and income reconciliation. It says it shared card information with payment card issuers and payment processors, with Hilton's Partner Accommodations, with Hilton's Third-Party Operator and with Hilton Principal, and that the information was not sold to a third party within the past 12 months.
Supporting quotations
Payment card information
We have obtained this personal information from the following sources:
Directly from consumers themselves
The third-party travel booking platform or travel agent through which a consumer made a reservation
We collected this personal information for the following business or commercial purposes:
Process payments, including conducting SCA when required by law
Detect and prevent fraud
Maintain books and records to comply with legal obligations for business reporting, auditing, tax, and income reconciliation
We have shared this personal information with the following categories of third parties
Payment card issuers and payment processors
Hilton's Partner Accommodations
Hilton's Third-Party Operator
Hilton Principal
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
Strong customer authentication is stated to apply only 'when required by law'.
The record-keeping purpose is tied to legal obligations for business reporting, auditing, tax and income reconciliation.
The sale answer covers the 12 months before August 31, 2026.
Data Access & Collection · Company practice
Hilton Honors number: obtained from members, used for reservations, service, verification and marketing
For the Hilton Honors number, Hilton says it obtained the information directly from Hilton Honors members themselves. The business or commercial purposes it lists are fulfilling guest reservations, sending guests communications about their reservations, administering membership and activity in the loyalty program, providing customer service and support, verifying the account, sending marketing communications by email, direct mail and social media, and performing analytics that provide guests with personalized offers and content and analytics that improve business operations.
Supporting quotations
Hilton Honors number
We have obtained this personal information from the following sources:
Directly from Hilton Honors members themselves
We collected this personal information for the following business or commercial purposes:
Fulfill guest reservations
Send guests communications relating to their reservations
Administer membership and activity in the Hilton Honors loyalty program
Provide customer service and support
Verify account
Send marketing communications via email, direct mail, and social media
Perform analytics in order to provide guests with personalized offers and content
Perform analytics to improve business operations
Qualifications & exceptions
The stated collection window is the 12 months before August 31, 2026.
This is the loyalty-programme identifier, distinct from the booking confirmation number used by travel agents and airline partners.
Sharing & Disclosure · Company practice
Arrival time: purposes, third-party sharing and the sale statement
Hilton lists the business or commercial purposes for arrival time as better serving guests, fulfilling reservations, personalizing the guest experience and providing customer service and support. It says it shared arrival time with Hilton Partner Accommodations, with Hilton's Third-Party Operator and with Hilton Principal, and that the information was not sold to a third party within the past 12 months.
Supporting quotations
We collected this personal information for the following business or commercial purposes:
Better serve our guests
Fulfill reservations
Personalize guest experience
Provide customer service and support
We have shared this personal information with the following categories of third parties
Hilton Partner Accommodations
Hilton's Third-Party Operator
Hilton Principal
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
The sale answer covers the 12 months before August 31, 2026.
Recipients are categories of third party rather than named companies.
Data Access & Collection · Company practice
Departure date: obtained from the guest, used for service and reservations, shared with partner hotels
For departure date, Hilton says it obtained the information directly from consumers themselves. The purposes it lists are better serving guests, fulfilling reservations and personalizing the guest experience. It says it shared the departure date with Hilton Partner Accommodations, with Hilton's Third-Party Operator and with Hilton Principal, and that the information was not sold to a third party within the past 12 months.
Supporting quotations
Departure date
We have obtained this personal information from the following sources:
Directly from consumers themselves
We collected this personal information for the following business or commercial purposes:
Better serve our guests
Fulfill reservations
Personalize guest experience
We have shared this personal information with the following categories of third parties
Hilton Partner Accommodations
Hilton's Third-Party Operator
Hilton Principal
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
The stated collection window is the 12 months before August 31, 2026.
Recipients are categories of third party rather than named companies.
Data Access & Collection · Company practice
Additional guest names: collected from the guest for reservations, shared with partners, sold
For additional guest names, Hilton says it obtained the information directly from consumers themselves and collected it to fulfill reservations. It says it shared the names with Hilton's Third-Party Partner, with Hilton Partner Accommodations and with Hilton's Third-Party Operator, and that the information was sold to a third party within the past 12 months.
Supporting quotations
Additional guest names
We have obtained this personal information from the following sources:
Directly from consumers themselves
We collected this personal information for the following business or commercial purposes:
Fulfill reservations
We have shared this personal information with the following categories of third parties
Hilton's Third-Party Partner
Hilton Partner Accommodations
Hilton's Third-Party Operator
This information was sold to a third party within the past 12 months
Yes
Qualifications & exceptions
The sale answer covers the 12 months before August 31, 2026.
The names are those of other people the guest supplies, so the collection concerns other individuals' information as well as the guest's.
Data Access & Collection · Company practice
Corporate travel planner information: from corporate contacts, shared with employers, not sold
For corporate travel planner information, Hilton says it obtained the information directly from the corporate contacts themselves. The purposes it lists are fulfilling and managing corporate travel reservations, providing customer service and support, and sending marketing communications by email, direct mail and social media. It says it shared the information with employers pursuant to corporate agreements, employee consent and as permitted by law, and that the information was not sold to a third party within the past 12 months.
Supporting quotations
Corporate travel planner information
We have obtained this personal information from the following sources:
Directly from the corporate contacts themselves
We collected this personal information for the following business or commercial purposes:
Fulfill and manage corporate travel reservations
Provide customer service and support
Send marketing communications via email, direct mail, and social media
We have shared this personal information with the following categories of third parties
Employers pursuant to corporate agreements, employee consent, and as permitted by law
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
The source here is the corporate contact, not the traveller directly.
Employer sharing is conditional on corporate agreements, employee consent and the law.
Marketing communications are a stated purpose, subject to the marketing choices the Statement sets out later.
Data Access & Collection · Company practice
Media contact data: from a communications service provider, used to contact media, not shared, not sold
For media contact data, Hilton says it obtained the information from a third-party communications service provider rather than from the person. The only stated purpose is contacting members of the media and social media influencers in their business capacity. It states that it does not share business contact data for members of the media and social media influencers with third parties, and that the information was not sold to a third party within the past 12 months.
Supporting quotations
Media contact data
We have obtained this personal information from the following sources:
From a third-party communications service provider
We collected this personal information for the following business or commercial purposes:
Contact members of the media and social media influencers in their business capacity
We have shared this personal information with the following categories of third parties
We do not share business contact data for members of the media and social media influencers with third parties
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
The contact is made in the person's business capacity as a member of the media or a social media influencer.
The sale answer covers the 12 months before August 31, 2026.
Data Access & Collection · Company practice
Corporate number and name: collected from the guest, shared with employers and partners, sold
For corporate number and name, Hilton says it obtained the information directly from consumers themselves. The purposes it lists are fulfilling reservations and determining guests' eligibility for special or promotional rates. It says it shared the information with employers pursuant to corporate agreements, employee consent and as permitted by law, with Hilton's Third-Party Partner and with Hilton's Third-Party Operator, and that the information was sold to a third party within the past 12 months.
Supporting quotations
Corporate number and name
We have obtained this personal information from the following sources:
Directly from consumers themselves
We collected this personal information for the following business or commercial purposes:
Fulfill reservations
Determine guests' eligibility for special or promotional rates
We have shared this personal information with the following categories of third parties
Employers pursuant to corporate agreements, employee consent, and as permitted by law
Hilton's Third-Party Partner
Hilton's Third-Party Operator
This information was sold to a third party within the past 12 months
Yes
Qualifications & exceptions
Employer sharing is conditional on corporate agreements, employee consent and the law.
The sale answer covers the 12 months before August 31, 2026.
Data Access & Collection · Company practice
Travel agent number and name: from the guest and from travel agents, used to attribute reservations
For travel agent number and name, Hilton says it obtained the information directly from consumers themselves and from travel agents. The purposes it lists are attributing reservations to travel agents and fulfilling the reservation. It says it shared the information with Hilton Grand Vacations, and that the information was sold to a third party within the past 12 months.
Supporting quotations
Travel agent number and name
We have obtained this personal information from the following sources:
Directly from consumers themselves
From travel agents
We collected this personal information for the following business or commercial purposes:
Property attribute reservations to travel agents
Fulfill your reservation
We have shared this personal information with the following categories of third parties
Hilton Grand Vacations
This information was sold to a third party within the past 12 months
Yes
Qualifications & exceptions
Attribution is a commercial purpose: the agent's identity is used to credit the booking.
The sale answer covers the 12 months before August 31, 2026.
Data Access & Collection · Company practice
Airline partner number and name: from the guest, used to attribute Points, shared with the airlines
For airline partner number and name, Hilton says it obtained the information directly from consumers themselves. The stated purpose is properly attributing Points to consumers who participate in airline loyalty programs. It says it shared the information with the respective airlines, with Hilton's Third-Party Partner and with Hilton's Third-Party Operator, and that the information was sold to a third party within the past 12 months.
Supporting quotations
Airline partner number and name
We have obtained this personal information from the following sources:
Directly from consumers themselves
We collected this personal information for the following business or commercial purposes:
Properly attribute Points to consumers who participate in airline loyalty programs
We have shared this personal information with the following categories of third parties
The respective airlines
Hilton's Third-Party Partner
Hilton's Third-Party Operator
This information was sold to a third party within the past 12 months
Yes
Qualifications & exceptions
Sharing with 'the respective airlines' means the airline linked to the member's own loyalty programme.
The sale answer covers the 12 months before August 31, 2026.
Sharing & Disclosure · Company practice
Hilton Honors number: remaining purposes, third-party sharing and the sale statement
The remaining purposes Hilton lists for the Hilton Honors number are determining guests' eligibility for special or promotional rates, processing payments, processing transactions with partners, administering contests and sweepstakes, and detecting and preventing fraud. It says it shared the number with service providers who perform tasks on its behalf, including providers that send marketing communications on its behalf; with Hilton's Third-Party Partner; with employers under corporate agreements, employee consent and as permitted by law; with third-party advertisers, for optimization and personalization on their platforms; with Hilton's Third-Party Operator; and with Hilton Principal. The sale answer for this category is Yes: the information was sold to a third party within the past 12 months.
Supporting quotations
Determine guests’ eligibility for special or promotional rates
Process payments
Process transactions with partners
Administer contests and sweepstakes
Detect and prevent fraud
We have shared this personal information with the following categories of third parties
Service providers who perform tasks on behalf of Hilton, which may include those who send marketing communications on our behalf
Hilton's Third-Party Partner
Employers pursuant to corporate agreements, employee consent, and as permitted by law
Third-party advertisers, for optimization and personalization on their platforms
Hilton's Third-Party Operator
Hilton Principal
This information was sold to a third party within the past 12 months
Yes
Qualifications & exceptions
The sale answer covers the 12 months before August 31, 2026.
Recipients are categories of third party rather than named companies.
Employer sharing requires corporate agreements, employee consent and the law.
Data Access & Collection · Company practice
WeChat ID: used to log into the Hilton Honors account, not shared with third parties, not sold
For the WeChat ID, Hilton says it obtained the information directly from consumers themselves and collected it to enable guests to log into their Hilton Honors account. It states plainly that it does not share customers' WeChat ID with third parties, and that the information was not sold to a third party within the past 12 months. The stated purpose is account access only.
Supporting quotations
WeChat ID
We have obtained this personal information from the following sources:
Directly from consumers themselves
We collected this personal information for the following business or commercial purposes:
Enable guests to log into Hilton Honors account
We have shared this personal information with the following categories of third parties
We do not share customers' WeChat ID with third parties
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
The no-sharing statement is a statement by Hilton about its own sharing; it is qualified by the 12-month sale period and by the separate China appendix rules.
The sale answer covers the 12 months before August 31, 2026.
Data Access & Collection · Company practice
WeChat name and profile photo: used for customer service, not shared, not sold
For the WeChat name and profile photo, Hilton says it obtained the information directly from consumers themselves and collected it to provide customer service and support. It states that it does not share customers' WeChat name and profile photo with third parties, and that the information was not sold to a third party within the past 12 months.
Supporting quotations
WeChat name and profile photo
We have obtained this personal information from the following sources:
Directly from consumers themselves
We collected this personal information for the following business or commercial purposes:
Provide customer service and support
We have shared this personal information with the following categories of third parties
We do not share customers' WeChat name and profile photo with third parties
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
The no-sharing statement covers Hilton's sharing; the China appendix in the same document sets out separate rules for WeChat data in China.
The sale answer covers the 12 months before August 31, 2026.
Data Access & Collection · Company practice
Passport or ID information: collected as law requires, shared with government agencies, not sold
For passport or ID information, Hilton says it obtained the information directly from consumers themselves and collected it pursuant to laws that require the collection of such data. It says it shared passport or ID information with government agencies pursuant to legal requirements in some countries, and that the information was not sold to a third party within the past 12 months. The stated basis is a legal requirement, not a Hilton service purpose.
Supporting quotations
Passport or ID information
We have obtained this personal information from the following sources:
Directly from consumers themselves
We collected this personal information for the following business or commercial purposes:
Pursuant to laws that require the collection of such data
We have shared this personal information with the following categories of third parties
Government agencies pursuant to legal requirements in some countries
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
The legal trigger and the government sharing are stated globally — 'laws that require the collection of such data' and 'some countries' — rather than for a named country.
The sale answer covers the 12 months before August 31, 2026.
Data Access & Collection · Company practice
Preferred language: read from the guest or device settings, used for service, Honors communications and analytics
For preferred language, Hilton says it obtained the information directly from consumers themselves, including from browser and computer settings, so the language preference can be inferred from the device as well as typed. The purposes it lists are better serving guests, providing a superior guest experience, sending communications relating to Hilton Honors, sending marketing communications, and performing analytics to provide guests with personalized offers and content. It says it shared the preference with Hilton's Third-Party Partner, with Hilton Partner Accommodations, with Hilton's Third-Party Operator and with Hilton Principal, and that the information was not sold to a third party within the past 12 months.
Supporting quotations
Preferred language
We have obtained this personal information from the following sources:
Directly from consumers themselves, including from browser and computer settings
We collected this personal information for the following business or commercial purposes:
Better serve our guests
Provide you with a superior guest experience
Send you communications relating to Hilton Honors
Send you marketing communications
Perform analytics in order to provide you with personalized offers and content
We have shared this personal information with the following categories of third parties
Hilton's Third-Party Partner
Hilton Partner Accommodations
Hilton's Third-Party Operator
Hilton Principal
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
Browser and computer settings are named as a source, so the preference may be device-derived rather than chosen in a Hilton form.
Marketing communications are a stated purpose, subject to the marketing choices the Statement sets out later.
The sale answer covers the 12 months before August 31, 2026.
Data Access & Collection · Company practice
Room preference: collected from the guest for service, personalization and analytics
For room preference, Hilton says it obtained the information directly from consumers themselves. The purposes it lists are better serving guests, fulfilling reservations, personalizing the guest's experience, performing analytics that provide guests with personalized offers and content, and performing analytics that improve business operations. It says it shared the preference with Hilton Partner Accommodations, with Hilton's Third-Party Operator and with Hilton Principal, and that the information was not sold to a third party within the past 12 months.
Supporting quotations
Room preference
We have obtained this personal information from the following sources:
Directly from consumers themselves
We collected this personal information for the following business or commercial purposes:
Better serve our guests
Fulfill your reservations
Personalize your experience
Perform analytics to provide you with personalized offers and content
Perform analytics to improve business operations
We have shared this personal information with the following categories of third parties
Hilton Partner Accommodations
Hilton's Third-Party Operator
Hilton Principal
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
The purposes cover the 12 months before August 31, 2026.
Recipients are categories of third party rather than named companies.
Data Access & Collection · Company practice
Room selection and assignment: guest choice on the app, Hilton assignment, shared with partner and principal
For room selection and assignment, the source of the information is described as a combination: guests can select their rooms on the Hilton Honors app and Hilton assigns rooms. The purposes listed are better serving guests and fulfilling reservations. Hilton says it shared this information with Hilton Partner Accommodations and with Hilton Principal, and that it was not sold to a third party within the past 12 months. The category therefore combines what the guest chose with what Hilton assigned.
Supporting quotations
Room selection and assignment
We have obtained this personal information from the following sources:
Guests can select their rooms on the Hilton Honors app and Hilton assigns rooms
We collected this personal information for the following business or commercial purposes:
Better serve our guests
Fulfill reservations
We have shared this personal information with the following categories of third parties
Hilton Partner Accommodations
Hilton Principal
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
The app room selection and the hotel's assignment are both recorded in this one category.
The sale answer covers the 12 months before August 31, 2026.
Data Access & Collection · Company practice
Arrival time: obtained directly from consumers
For arrival time, the collection summary states that Hilton obtained the information directly from consumers themselves. The business purposes and the third-party sharing for this category are set out in the following part of the summary.
Supporting quotations
Arrival time
We have obtained this personal information from the following sources:
Directly from consumers themselves
Qualifications & exceptions
Only the source of this category is stated in this part; the rest of the category is set out in the next part of the summary.
Data Access & Collection · Company practice
Vehicle information: from plate recognition and cameras, used for parking and safety, not shared
For vehicle information, Hilton says it obtained the information directly from consumers themselves, from license plate recognition technology and from video capabilities, so the vehicle can be identified by the guest, by reading the plate or by cameras. The purposes it lists are enabling guests to park at its properties and ensuring safety and security. It states that it does not share vehicle information with any third parties, and that the information was not sold to a third party within the past 12 months.
Supporting quotations
Vehicle information
We have obtained this personal information from the following sources:
Directly from consumers themselves
From license plate recognition technology
From video capabilities
We collected this personal information for the following business or commercial purposes:
Enable guests to park at our properties
Ensure safety and security
We have shared this personal information with the following categories of third parties
We do not share vehicle information with any third parties
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
Two of the three sources are automated rather than the guest's own entry.
The no-sharing statement is Hilton's own statement about its sharing.
The sale answer covers the 12 months before August 31, 2026.
Data Access & Collection · Company practice
CCTV footage: recorded by property cameras, used for safety and legal compliance, shared in limited cases
For CCTV footage, the source is cameras located on and around the property, not the guest. The purposes are protecting guests, employees and visitors to properties, and complying with applicable laws that require this collection in some jurisdictions. Hilton says it shared the footage with government agencies pursuant to legal requirements in some countries, with employers pursuant to corporate agreements, employee consent and as permitted by law, and with entities that arranged a special rate plan, an event or a room block with Hilton, as permitted by law. It was not sold to a third party within the past 12 months.
Supporting quotations
CCTV footage
We have obtained this personal information from the following sources:
Directly from cameras located on and around the property
We collected this personal information for the following business or commercial purposes:
Protect guests, employees and visitors to properties
Comply with applicable laws that require us to collect this information in some jurisdictions
We have shared this personal information with the following categories of third parties
Government agencies pursuant to legal requirements in some countries
Employers pursuant to corporate agreements, employee consent, and as permitted by law
Entities that have arranged a special rate plan with Hilton and/or organized an event and/or room block with Hilton, as permitted by law
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
Footage is collected by cameras on and around the property, so people other than the guest are recorded.
Each sharing ground is qualified: legal requirements in some countries, corporate agreements and employee consent, and 'as permitted by law' for rate-plan, event and room-block entities.
The sale answer covers the 12 months before August 31, 2026.
Use & Processing · Company practice
Promotional images: photographed on the property, used in promotions, shared with promotion partners
For promotional images, Hilton says it obtained the information directly from cameras utilized on the property, and that the purpose is internal and external promotions and communications. It says it shares promotional images with third parties that facilitate promotions, and that the information was not sold to a third party within the past 12 months. Unlike the CCTV category, promotional images are stated to be shared with promotion partners.
Supporting quotations
Promotional Images
We have obtained this personal information from the following sources:
Directly from cameras utilized on the property
We collected this personal information for the following business or commercial purposes:
Internal and external promotions and communications
We have shared this personal information with the following categories of third parties
We share promotional images with third parties that facilitate promotions
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
Images are captured by property cameras, so people may appear in them without giving them for this purpose.
The sale answer covers the 12 months before August 31, 2026.
Data Access & Collection · Company practice
Customer interactions: cookies, server logs, beacons, tags and pixels used for analytics and marketing
For customer interactions with Hilton, the source is stated to be consumers themselves, obtained via cookies, server logs, web beacons, tags, pixels and other similar technologies. The purposes listed are performing analytics that provide personalized offers and content, performing analytics that improve business operations, marketing, sharing that data with advertising networks that serve personalized advertisements, detecting and preventing fraud, and optimizing Hilton's websites and mobile apps. It says it shared the data with advertising networks and with analytics providers for its websites and mobile applications, and that the information was sold to a third party within the past 12 months. A separate note says that if a user asks the Hilton Honors iOS app not to track across other companies' apps and websites, Hilton honours that request, while emails about searched properties and about Hilton–American Express co-branded credit cards may still arrive, those card emails not being sent based on iOS tracking.
Supporting quotations
Customer interactions with Hilton
We have obtained this personal information from the following sources:
Directly from consumers themselves via cookies, server logs, web beacons, tags, pixels, and other similar technologies
We collected this personal information for the following business or commercial purposes:
Perform analytics to provide you with personalized offers and content
Perform analytics to improve business operations
Marketing
Share that data with advertising networks who serve personalized advertisements
Detect and prevent fraud
Optimize our websites and mobile apps
We have shared this personal information with the following categories of third parties
Advertising networks
Analytics providers for our websites and mobile applications
This information was sold to a third party within the past 12 months
Yes
Note: If in the Hilton Honors iOS App you ask the App not to track you across other companies’ apps and websites, Hilton will honor that request.
Qualifications & exceptions
The interaction data is collected through tracking technologies, so it records behaviour rather than content the guest typed.
The sale answer covers the 12 months before August 31, 2026.
The iOS tracking note is limited to the Hilton Honors iOS app and the cross-app tracking request; it does not withdraw marketing emails or card-related emails.
Data Access & Collection · Company practice
IP addresses: from browsing, used for analytics, advertising, payment authentication, troubleshooting and fraud
For IP addresses, the source is consumers themselves as a result of their browsing activity on the internet. The purposes listed are performing analytics that provide guests with personalized offers and content, performing analytics that improve business operations, sharing the data with advertising networks that serve personalized advertisements, conducting strong customer authentication as part of the payment process when required by law, optimizing Hilton's websites and mobile apps, troubleshooting and resolving website issues, and detecting and preventing fraud.
Supporting quotations
IP addresses
We have obtained this personal information from the following sources:
Directly from consumers themselves as a result of their browsing activity on the internet
We collected this personal information for the following business or commercial purposes:
Perform analytics in order to provide guests with personalized offers and content
Perform analytics to improve business operations
Share that data with advertising networks who serve personalized advertisements
Conduct SCA as part of the payment process, when required by law
Optimize our websites and mobile apps
Troubleshoot and resolve website issues
Detect and prevent fraud
Qualifications & exceptions
Strong customer authentication is stated to apply only 'when required by law'.
The purposes cover the 12 months before August 31, 2026.
Sharing & Disclosure · Company practice
IP addresses: sharing with advertising networks, analytics providers, service providers and card issuers, not sold
Hilton says it shared IP addresses with advertising networks, with analytics providers for its websites and mobile applications, with service providers who perform tasks on its behalf — which may include those who send marketing communications on its behalf — and with payment card issuers and payment processors, but only when conducting strong customer authentication. It says the information was not sold to a third party within the past 12 months.
Supporting quotations
We have shared this personal information with the following categories of third parties
Advertising networks
Analytics providers for our websites and mobile applications
Service providers who perform tasks on behalf of Hilton, which may include those who send marketing communications on our behalf
Payment card issuers and payment processors (only when conducting SCA)
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
The payment-card recipient is limited to the strong customer authentication case.
The sale answer covers the 12 months before August 31, 2026.
Data Access & Collection · Company practice
Session IDs: from browsing, used for personalization analytics and marketing
For session IDs, the source is consumers themselves as a result of their browsing activity on the internet. The purposes listed begin with performing analytics that provide guests with personalized offers and content and marketing; the remaining purposes and the sharing and sale status for this category are set out in the following part of the summary.
Supporting quotations
Session IDs
We have obtained this personal information from the following sources:
Directly from consumers themselves as a result of their browsing activity on the internet
We collected this personal information for the following business or commercial purposes:
Perform analytics in order to provide guests with personalized offers and content
Marketing
Qualifications & exceptions
Only the first purposes of this category are stated in this part; the rest of the category is set out in the next part of the summary.
Sharing & Disclosure · Company practice
Session IDs: remaining purposes, sharing with advertising networks, and the sale statement
The remaining purposes for session IDs are performing analytics that improve business operations, sharing the data with advertising networks that serve personalized advertisements, and detecting and preventing fraud. Hilton says it shared session IDs with advertising networks and with analytics providers for its websites and mobile applications, and that the information was sold to a third party within the past 12 months.
Supporting quotations
Perform analytics to improve business operations
Share that data with advertising networks who serve personalized advertisements
Detect and prevent fraud
We have shared this personal information with the following categories of third parties
Advertising networks
Analytics providers for our websites and mobile applications
This information was sold to a third party within the past 12 months
Yes
Qualifications & exceptions
The sale answer covers the 12 months before August 31, 2026.
Recipients are categories of third party rather than named companies.
Data Access & Collection · Company practice
Booking engine data: from browsing, used for targeted media advertising and marketing, shared with advertising networks
For booking engine data, the source is consumers as a result of their browsing activity on the internet. The purposes are showing targeted advertisements on media, supporting marketing efforts, providing customer service and performing analytics to improve business operations. Hilton says it shared the data with advertising networks, with analytics providers for its websites and mobile applications and with Hilton Principal, and that the information was sold to a third party within the past 12 months.
Supporting quotations
Booking engine
We have obtained this personal information from the following sources:
Directly from consumers as a result of their browsing activity on the internet
We collected this personal information for the following business or commercial purposes:
Show you targeted advertisements on media
Support marketing efforts
Provide customer service
Perform analytics to improve business operations
We have shared this personal information with the following categories of third parties
Advertising networks
Analytics providers for our websites and mobile applications
Hilton Principal
This information was sold to a third party within the past 12 months
Yes
Qualifications & exceptions
The sale answer covers the 12 months before August 31, 2026.
The booking engine data is behaviour from browsing, not the reservation itself.
Data Access & Collection · Company practice
Streaming service usage: from Connected Room login, used to evaluate streaming usage, not shared
For streaming service usage, the source is consumers as a result of their logging into a streaming service through the Connected Room functionality. The only stated purpose is evaluating the usage of different streaming services. Hilton says it does not share streaming service usage with third parties, and that the information was not sold to a third party within the past 12 months.
Supporting quotations
Streaming service usage
We have obtained this personal information from the following sources:
Directly from consumers as a result of their logging into a streaming service through Connected Room functionality
We collected this personal information for the following business or commercial purposes:
Evaluate the usage of different streaming services
We have shared this personal information with the following categories of third parties
We do not share streaming service usage with third parties
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
The data arises when a guest logs into a third-party streaming service in the room.
The sale answer covers the 12 months before August 31, 2026.
Data Access & Collection · Company practice
Hilton and Amex co-branded card data: from American Express, used for card benefits and marketing
For the Hilton and Amex credit card category, the source is American Express, not the guest directly. The purposes are providing the benefits associated with the co-branded card, showing targeted advertisements on media, supporting marketing efforts, providing customer service and performing analytics to improve business operations. The stated purposes do not include any payments-related use, although the following sharing entry names payment card issuers and processors as a recipient of this data.
Supporting quotations
Hilton and Amex credit card
We have obtained this personal information from the following sources:
From American Express
We collected this personal information for the following business or commercial purposes:
Provide you with benefits associated with your co-branded card
Show you targeted advertisements on media
Support marketing efforts
Provide customer service
Perform analytics to improve business operations
Qualifications & exceptions
The source is the co-branded partner, so Hilton receives the data from American Express.
The purposes cover the 12 months before August 31, 2026.
Sharing & Disclosure · Company practice
Hilton and American Express co-branded card data: sharing and the sale statement
Hilton says it shared the co-branded card data with advertising networks, with analytics providers for its websites and mobile applications, with Hilton Honors affiliated partners, with Hilton Partner Accommodations and with Hilton's Third-Party Operator, and that the information was not sold to a third party within the past 12 months.
Supporting quotations
We have shared this personal information with the following categories of third parties
Advertising networks
Analytics providers for our websites and mobile applications
Hilton Honors affiliated partners
Hilton Partner Accommodations
Hilton's Third-Party Operator
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
Recipients are categories of third party rather than named companies.
The sale answer covers the 12 months before August 31, 2026.
Data Access & Collection · Company practice
Hilton and Amazon account data: from Amazon, used for Shop with Points, advertising and marketing
For the Hilton and Amazon accounts category, the source is Amazon. The purposes are facilitating use of Honors Points as part of Amazon's Shop with Points program, showing targeted advertisements on media, supporting marketing efforts, providing customer service and performing analytics to improve business operations. Hilton says it shared the data with advertising networks and with analytics providers for its websites and mobile applications, and that the information was not sold to a third party within the past 12 months.
Supporting quotations
Hilton and Amazon accounts
We have obtained this personal information from the following sources:
From Amazon
We collected this personal information for the following business or commercial purposes:
Facilitate use of Honors Points as part of Amazon's Shop with Points program
Show you targeted advertisements on media
Support marketing efforts
Provide customer service
Perform analytics to improve business operations
We have shared this personal information with the following categories of third parties
Advertising networks
Analytics providers for our websites and mobile applications
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
The source is the partner account, so the data reaches Hilton from Amazon.
The sale answer covers the 12 months before August 31, 2026.
Data Access & Collection · Company practice
Hilton and Lyft account data: from Lyft, used for advertising, marketing and analytics
For the Hilton and Lyft accounts category, the source is Lyft. The purposes are showing targeted advertisements on media, supporting marketing efforts, providing customer service and performing analytics to improve business operations. Hilton says it shared the data with advertising networks, with analytics providers for its websites and mobile applications and with Hilton Honors affiliated partners, and that the information was not sold to a third party within the past 12 months. No ride-hailing or transportation purpose is stated in this category.
Supporting quotations
Hilton and Lyft accounts
We have obtained this personal information from the following sources:
From Lyft
We collected this personal information for the following business or commercial purposes:
Show you targeted advertisements on media
Support marketing efforts
Provide customer service
Perform analytics to improve business operations
We have shared this personal information with the following categories of third parties
Advertising networks
Analytics providers for our websites and mobile applications
Hilton Honors affiliated partners
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
The source is the partner account, so the data reaches Hilton from Lyft.
The sale answer covers the 12 months before August 31, 2026.
Data Access & Collection · Company practice
Geolocation information: from browsing and app use, used for room access, Digital Key, analytics and marketing
For geolocation information, the source is consumers as a result of their browsing activity on the internet and their use of the Hilton Honors app. The purposes listed are enabling guest access to guest room and hotel facilities, fulfilling Digital Key sharing requests, performing analytics that provide guests with personalized offers and content, marketing, and detecting and preventing fraud. Hilton states that it does not share geolocation information with any third parties; the sale status for this category is set out in the following part of the summary.
Supporting quotations
Geolocation information
We have obtained this personal information from the following sources:
Directly from consumers as a result of their browsing activity on the internet and use of the Hilton Honors app
We collected this personal information for the following business or commercial purposes:
Enable guest access to guest room and hotel facilities
Fulfill Digital Key sharing requests
Perform analytics in order to provide guests with personalized offers and content
Marketing
Detect and prevent fraud
We have shared this personal information with the following categories of third parties
We do not share geolocation information with any third parties.
Qualifications & exceptions
The data combines internet browsing location with in-app location, so it is not limited to the property.
The no-sharing statement covers Hilton's own sharing of geolocation information.
Sharing & Disclosure · Company practice
Geolocation information: not sold to a third party in the past 12 months
The sale status for geolocation information completes the category: Hilton states the information was not sold to a third party within the past 12 months. Read with the earlier statement that it does not share geolocation information with any third parties, the category is described as neither shared nor sold.
Supporting quotations
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
The sale answer covers the 12 months before August 31, 2026.
Data Access & Collection · Company practice
Device information: from browsing, QR scans and the Honors app, used for analytics, marketing and advertising
For device information, Hilton says it obtained the information from consumers as a result of their browsing activity on the internet, scanning of QR codes on property, and use of the Hilton Honors app. The purposes are performing analytics that provide personalized offers and content, marketing, sharing the data with advertising networks that serve personalized advertisements, and detecting and preventing fraud. It says it shared the data with advertising networks and with analytics providers for its websites and mobile applications, and that the information was sold to a third party within the past 12 months.
Supporting quotations
Device information
We have obtained this personal information from the following sources:
Directly from consumers as a result of their browsing activity on the internet, scanning of QR codes on property, and use of the Hilton Honors app
We collected this personal information for the following business or commercial purposes:
Perform analytics to provide you with personalized offers and content
Marketing
Share that data with advertising networks who serve personalized advertisements
Detect and prevent fraud
We have shared this personal information with the following categories of third parties
Advertising networks
Analytics providers for our websites and mobile applications
This information was sold to a third party within the past 12 months
Yes
Qualifications & exceptions
The sources include on-property QR scanning and app use, not only web browsing.
The sale answer covers the 12 months before August 31, 2026.
Data Access & Collection · Company practice
Social media information: from the guest, from public social channels and public online sources, not shared
For social media information, Hilton names three sources: directly from consumers themselves; indirectly from consumers by reviewing publicly available information on their social media channels; and from publicly available online sources. The purposes are performing analytics that provide guests with personalized offers and content, responding to service concerns in order to better serve guests, and providing a more personalized welcome and stay experience. Hilton states that it does not share social media information or publicly available online information with any third parties, and that the information was not sold to a third party within the past 12 months.
Supporting quotations
Social media information
We have obtained this personal information from the following sources:
Directly from consumers themselves
Indirectly from consumers by reviewing publicly available information on their social media channels
From publicly available online sources
We collected this personal information for the following business or commercial purposes:
Perform analytics in order to provide guests with personalized offers and content
Respond to service concerns in order to better serve our guests
Provide a more personalized welcome and stay experience
We have shared this personal information with the following categories of third parties
We do not share social media information or publicly available online information with any third parties
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
Two of the three sources are information Hilton finds without the guest giving it to Hilton directly.
The no-sharing statement covers social media information and publicly available online information.
The sale answer covers the 12 months before August 31, 2026.
Linking & Identification · Company practice
Demographics data: from third-party demographics companies, linked to Hilton's own file, not shared
For demographics data, the source is third-party companies that provide demographics data. The purposes are performing analytics that provide guests with personalized offers and content, and linking with customer information that Hilton already has on file. Hilton states that it does not share demographics data with any third parties, and that the information was not sold to a third party within the past 12 months. The stated linking purpose is the significant one: externally sourced demographic attributes are matched against the customer records Hilton already holds.
Supporting quotations
Demographics data
We have obtained this personal information from the following sources:
From third-party companies that provide demographics data
We collected this personal information for the following business or commercial purposes:
Perform analytics in order to provide guests with personalized offers and content
Link with customer information that Hilton already has on file
We have shared this personal information with the following categories of third parties
We do not share demographics data with any third parties
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
The second purpose is record linkage, which joins data bought from a third party to Hilton's existing customer file.
The sale answer covers the 12 months before August 31, 2026.
Data Access & Collection · Company practice
MyWay preferences: from the guest, used for service and requested communications
For the guest's MyWay preferences, Hilton says it obtained the information directly from consumers themselves. The purposes are better serving guests and sending the communications the guest would like to receive. It says it shared the preferences with Hilton Partner Accommodations, with Hilton's Third-Party Operator and with Hilton Principal, and that the information was not sold to a third party within the past 12 months.
Supporting quotations
Your MyWay preferences
We have obtained this personal information from the following sources:
Directly from consumers themselves
We collected this personal information for the following business or commercial purposes:
Better serve our guests
Send you the communications you would like to receive
We have shared this personal information with the following categories of third parties
Hilton Partner Accommodations
Hilton's Third-Party Operator
Hilton Principal
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
The stated purpose includes sending the communications the guest asked for, which is distinct from marketing communications the guest did not request.
Recipients are categories of third party rather than named companies.
Data Access & Collection · Company practice
Email and consent preferences: from the guest, used for service and requested communications, shared with advertising
For email and consent preferences, Hilton says it obtained the information directly from consumers themselves. The purposes are better serving guests and sending the communications the guest would like to receive. It says it shared the preferences with advertising networks, and that the information was not sold to a third party within the past 12 months. Consent choices are therefore recorded and, unlike the MyWay preferences category, are shared with advertising networks.
Supporting quotations
Email and consent preferences
We have obtained this personal information from the following sources:
Directly from consumers themselves
We collected this personal information for the following business or commercial purposes:
Better serve our guests
Send you the communications you would like to receive
We have shared this personal information with the following categories of third parties
Advertising networks
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
The sale answer covers the 12 months before August 31, 2026.
The Statement's separate marketing choices section explains how consent is withdrawn; this category records the preference.
Data Access & Collection · Company practice
Personal preferences: from the guest, used for service, shared with partner accommodations, not sold
For personal preferences, Hilton says it obtained the information directly from consumers themselves. The purposes are better serving guests and providing customer service and support. It says it shared the preferences with Hilton Partner Accommodations, and that the information was not sold to a third party within the past 12 months.
Supporting quotations
Personal preferences
We have obtained this personal information from the following sources:
Directly from consumers themselves
We collected this personal information for the following business or commercial purposes:
Better serve our guests
Provide customer service and support
We have shared this personal information with the following categories of third parties
Hilton Partner Accommodations
This information was sold to a third party within the past 12 months No
Qualifications & exceptions
Only partner accommodations are listed as recipients for this category.
The sale answer covers the 12 months before August 31, 2026.
Data Access & Collection · Company practice
On-site incidents: reported by guests, employees or law enforcement, used for safety, service and legal compliance
For on-site incidents, Hilton names three sources: directly from consumers themselves, directly from Hilton employees, and directly from law enforcement. The purposes are responding to safety and security concerns, better serving guests, and complying with legal or contractual obligations. It says it shared incident information with law enforcement, with employers pursuant to corporate agreements, employee consent and as permitted by law, and with entities that arranged a special rate plan, an event or a room block with Hilton; the sharing list continues in the next part of the summary.
Supporting quotations
On-site incidents
We have obtained this personal information from the following sources:
Directly from consumers themselves
Directly from Hilton employees
Directly from law enforcement
We collected this personal information for the following business or commercial purposes:
Respond to safety and security concerns
Better serve our guests
Comply with legal or contractual obligations
We have shared this personal information with the following categories of third parties
Law enforcement
Employers pursuant to corporate agreements, employee consent, and as permitted by law
Entities that have arranged a special rate plan with Hilton and/or organized an event and/or room block with Hilton
Qualifications & exceptions
One source is law enforcement, so incidents can enter Hilton's records from official channels rather than from the guest.
Employer sharing is conditional on corporate agreements, employee consent and the law.
Sharing & Disclosure · Company practice
On-site incidents: sharing with franchise property owners and others required by law
The sharing list for on-site incidents continues: Hilton says it shared the information with the management and/or owners of a franchise property if the incident relates to that property, and with others as required by law. It says the information was not sold to a third party within the past 12 months. The franchise-property disclosure is conditional on the incident relating to that property, and the second ground is limited to what the law requires.
Supporting quotations
The management and/or owners of a franchise property if the incident relates to that property
Others as required by law
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
Franchise owners receive the information only where the incident relates to their property.
'Others as required by law' is limited to legal requirement.
The sale answer covers the 12 months before August 31, 2026.
Data Access & Collection · Company practice
Complaint descriptions: from the guest, used for safety, service and legal compliance, shared with franchise owners
For complaint descriptions, Hilton says it obtained the information directly from consumers themselves. The purposes are responding to safety and security concerns, better serving guests, and complying with legal or contractual obligations. It says it shared the complaint description with the management and/or owners of a franchise property if the complaint relates to that property, and that the information was not sold to a third party within the past 12 months.
Supporting quotations
Complaint descriptions
We have obtained this personal information from the following sources:
Directly from consumers themselves
We collected this personal information for the following business or commercial purposes:
Respond to safety and security concerns
Better serve our guests
Comply with legal or contractual obligations
We have shared this personal information with the following categories of third parties
The management and/or owners of a franchise property if your complaint relates to that property
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
Franchise owners receive the complaint only where the complaint relates to their property.
The sale answer covers the 12 months before August 31, 2026.
Use & Processing · Company practice
Customer ratings and survey responses: published with consent, identifiable responses not shared
For customer ratings and survey responses, Hilton says it obtained the information directly from consumers themselves. The purposes are troubleshooting and resolving website issues, improving the customer experience, and — with the guest's consent where required — displaying or publishing guest feedback, survey responses, ratings, testimonials or excerpts of comments on Hilton websites, mobile applications or other promotional materials to help inform other travellers about guest experiences at its properties. It says it does not share identifiable customer ratings and survey responses with any third parties, and that the information was not sold to a third party within the past 12 months.
Supporting quotations
Customer ratings and survey responses
We have obtained this personal information from the following sources:
Directly from consumers themselves
We collected this personal information for the following business or commercial purposes:
Troubleshoot and resolve website issues
Improve customer experience
With your consent where required, display or publish guest feedback, survey responses, ratings, testimonials, or excerpts of comments on Hilton websites, mobile applications, or other promotional materials to help inform other travelers about guest experiences at our properties.
We have shared this personal information with the following categories of third parties
We do not share identifiable customer ratings and survey responses with any third parties.
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
Publication of guest feedback is qualified by the guest's consent where required.
The no-sharing statement is limited to identifiable ratings and survey responses.
The sale answer covers the 12 months before August 31, 2026.
Data Access & Collection · Company practice
Free form textual feedback: from the guest, used for troubleshooting and improvement, not shared
For free form textual feedback, Hilton says it obtained the information directly from consumers themselves. The purposes are troubleshooting and resolving website issues and improving the customer experience. It states that it does not share the guest's feedback with any third parties, and that the information was not sold to a third party within the past 12 months. Unlike ratings and survey responses, this category carries no publication purpose.
Supporting quotations
Free form textual feedback
We have obtained this personal information from the following sources:
Directly from consumers themselves
We collected this personal information for the following business or commercial purposes:
Troubleshoot and resolve website issues
Improve customer experience
We have shared this personal information with the following categories of third parties
We do not share your feedback with any third parties
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
The sale answer covers the 12 months before August 31, 2026.
Data Access & Collection · Company practice
Spa and wellness service information: date, time and service type, used for safety and compliance, not shared
For spa and wellness service information, Hilton describes the information as such as date, time and type of service, obtained directly from consumers themselves. The purposes are responding to safety and security concerns, better serving guests, and complying with legal or contractual obligations. Hilton states that it does not share spa and wellness service or treatment details with any third parties, and that the information was not sold to a third party within the past 12 months.
Supporting quotations
Spa and wellness service information
We have obtained this personal information (such as date, time, and type of service) from the following sources:
Directly from consumers themselves
We collected this personal information for the following business or commercial purposes:
Respond to safety and security concerns
Better serve our guests
Comply with legal or contractual obligations
We have shared this personal information with the following categories of third parties
We do not share your spa and wellness service or treatment details with any third parties.
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
The category covers service details such as date, time and type of service.
The sale answer covers the 12 months before August 31, 2026.
Data Access & Collection · Company practice
Spending amount: from the guest, used for service, analytics, marketing and financial reporting, shared with card
For spending amount, Hilton says it obtained the information directly from consumers themselves. The purposes are better serving guests, performing analytics to improve business operations, supporting marketing efforts, and fulfilling obligations for business reporting, auditing, tax and income reconciliation. It says it shared the amount with payment card issuers and payment processors, and that the information was not sold to a third party within the past 12 months.
Supporting quotations
Spending amount
We have obtained this personal information from the following sources:
Directly from consumers themselves
We collected this personal information for the following business or commercial purposes:
Better serve our guests
Perform analytics to improve business operations
Support marketing efforts
Fulfill obligations for business reporting, auditing, tax, and income reconciliation
We have shared this personal information with the following categories of third parties
Payment card issuers and payment processors
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
One stated purpose is meeting financial and reporting obligations rather than serving the guest.
The sale answer covers the 12 months before August 31, 2026.
Data Access & Collection · Company practice
Stay add-ons such as parking, pets, time and extra add-ons: from the guest, shared with Hilton Principal
For stay add-ons — the document lists parking, pets, time and extra add-ons — Hilton says it obtained the information directly from consumers themselves. The purposes are better serving guests and improving the customer experience. It says it shared the information with Hilton Principal, and that the information was not sold to a third party within the past 12 months.
Supporting quotations
Stay Add-Ons (such as parking, pets, time, and extra add-ons)
We have obtained this personal information from the following sources:
Directly from consumers themselves
We collected this personal information for the following business or commercial purposes:
Better serve our guests
Improve customer experience
We have shared this personal information with the following categories of third parties
Hilton Principal
This information was sold to a third party within the past 12 months
No
Qualifications & exceptions
The category covers the add-ons bought during a stay, such as parking, pets and extra time.
The sale answer covers the 12 months before August 31, 2026.
Data Access & Collection · Company practice
Point of collection: categories and purposes disclosed when you browse a Hilton website
The Statement adds a notice at the point of collection. For browsing Hilton websites it says that it collects categories of personal information about the visitor, which are used for stated purposes, and the first category is interaction information with Hilton websites, apps, emails or ads — such as open time, clicked links and version — collected in order to show targeted advertisements on marketing efforts including media, email and chat, with the example that a search for Hilton properties in New York City can lead to a Hilton advertisement on a non-Hilton website. The remaining categories and purposes of this notice follow in the next part of the section.
Supporting quotations
Browsing Hilton Websites
When you browse a Hilton website, we collect the following categories of personal information about you, which are used for the following purposes:
Interaction information with Hilton websites, apps, emails or ads (such as open time, clicked links, and version)
We collect this information in order to:
Show you targeted advertisements on marketing efforts including media, email, and chat
Qualifications & exceptions
The point-of-collection notice is the short, activity-based list; the general collection summary in the same document is the fuller retrospective list.
The advertising example is given as an illustration of what may happen, not as a promise that it will.
Use & Processing · Company practice
Point of collection, browsing: remaining purposes of interaction information
The point-of-collection notice for browsing Hilton websites states further purposes for the interaction information it collects: optimizing Hilton's websites and mobile apps, performing analytics that improve business operations, performing analytics that provide guests with personalized offers and content, marketing, sharing that data with advertising networks that serve personalized advertisements, and detecting and preventing fraud.
Supporting quotations
Optimize our websites and mobile apps
Perform analytics to improve business operations
Perform analytics in order to provide guests with personalized offers and content
Marketing
Share that data with advertising networks who serve personalized advertisements
Detect and prevent fraud
Qualifications & exceptions
These purposes sit in the point-of-collection notice for browsing; the general collection summary in the same document lists the same kinds of uses for a 12-month retrospective period.
Data Access & Collection · Company practice
Point of collection, browsing: IP address and its purposes
In the point-of-collection notice for browsing, the IP address is collected in order to: perform analytics that provide guests with personalized offers and content; show targeted advertisements on media; optimize Hilton's websites and mobile apps; perform analytics that improve business operations; share the data with advertising networks that serve personalized advertisements; conduct strong customer authentication as part of the payment process when required by law; troubleshoot and resolve website issues; and detect and prevent fraud.
Supporting quotations
IP address
We collect this information in order to:
Perform analytics in order to provide guests with personalized offers and content
Show you targeted advertisements on media
Optimize our websites and mobile apps
Perform analytics to improve business operations
Share that data with advertising networks who serve personalized advertisements
Conduct SCA as part of the payment process, when required by law
Troubleshoot and resolve website issues
Detect and prevent fraud
Qualifications & exceptions
Strong customer authentication is stated to apply only 'when required by law'.
The point-of-collection list states purposes, not the recipients of the data; the sharing list is given in the general collection summary.
Data Access & Collection · Company practice
Point of collection, browsing: session ID and its purposes
In the point-of-collection notice for browsing, the session ID is collected in order to: perform analytics that provide guests with personalized offers and content; marketing; show targeted advertisements on media; optimize Hilton's websites and mobile apps; perform analytics that improve business operations; share the data with advertising networks that serve personalized advertisements; and detect and prevent fraud.
Supporting quotations
Session ID
We collect this information in order to:
Perform analytics in order to provide guests with personalized offers and content
Marketing
Show you targeted advertisements on media
Optimize our websites and mobile apps
Perform analytics to improve business operations
Share that data with advertising networks who serve personalized advertisements
Detect and prevent fraud
Qualifications & exceptions
The point-of-collection list states purposes, not the recipients of the data.
Data Access & Collection · Company practice
Point of collection, browsing: booking engine data and its purposes
In the point-of-collection notice for browsing, booking engine data is collected in order to: show targeted advertisements on media; support marketing efforts; provide customer service; and perform analytics to improve business operations.
Supporting quotations
Booking engine
We collect this information in order to:
Show you targeted advertisements on media
Support marketing efforts
Provide customer service
Perform analytics to improve business operations
Qualifications & exceptions
The point-of-collection list states purposes, not the recipients of the data.
Data Access & Collection · Company practice
Point of collection, browsing: Hilton and Lyft account data and its purposes
In the point-of-collection notice for browsing, data linked to a member's Hilton and Lyft accounts is collected in order to: show targeted advertisements on media; support marketing efforts; provide customer service; and perform analytics to improve business operations.
Supporting quotations
Hilton and Lyft accounts
We collect this information in order to:
Show you targeted advertisements on media
Support marketing efforts
Provide customer service
Perform analytics to improve business operations
Qualifications & exceptions
The point-of-collection list states purposes, not the recipients of the data.
Data Access & Collection · Company practice
Point of collection: information collected when a member logs in during a browsing session
The notice says that if a Hilton Honors member logs into their account during a browsing session, Hilton collects the following information about them and uses it for the following purposes. The first category is internet or network activity information, collected in order to: show targeted advertisements on marketing efforts including media, email and chat; optimize Hilton's websites and mobile apps; perform analytics that improve business operations; perform analytics that provide guests with personalized offers and content; marketing; share that data with advertising networks that serve personalized advertisements; and detect and prevent fraud. The advertising example given is that a search for Hilton properties in New York City can lead to a Hilton advertisement on a non-Hilton website.
Supporting quotations
If you are a Hilton Honors member and you log into your account during your browsing session, then we collect the following information about you, which is used for the following purposes:
Internet or network activity information
We collect this information in order to:
Show you targeted advertisements on marketing efforts including media, email, and chat
Optimize our websites and mobile apps
Perform analytics to improve business operations
Perform analytics in order to provide guests with personalized offers and content
Marketing
Share that data with advertising networks who serve personalized advertisements
Detect and prevent fraud
Qualifications & exceptions
This collection is described for members who log in during browsing; the other categories of the logged-in list follow in the next part of the section.
The New York City example illustrates what may happen rather than promising that it will.
Data Access & Collection · Company practice
Point of collection, logged-in browsing: IP address and its purposes
Within the logged-in browsing list, the IP address is collected in order to: perform analytics that provide guests with personalized offers and content; share that data with advertising networks that serve personalized advertisements; conduct strong customer authentication as part of the payment process when required by law; show targeted advertisements on media; optimize Hilton's websites and mobile apps; troubleshoot and resolve website issues; perform analytics that improve business operations; and detect and prevent fraud.
Supporting quotations
IP address
We collect this information in order to:
Perform analytics in order to provide guests with personalized offers and content
Share that data with advertising networks who serve personalized advertisements
Conduct SCA as part of the payment process, when required by law
Show you targeted advertisements on media
Optimize our websites and mobile apps
Troubleshoot and resolve website issues
Perform analytics to improve business operations
Detect and prevent fraud
Qualifications & exceptions
Strong customer authentication is stated to apply only 'when required by law'.
The point-of-collection list states purposes, not the recipients of the data.
Data Access & Collection · Company practice
Point of collection, logged-in browsing: session ID and its purposes
Within the logged-in browsing list, the session ID is collected in order to: perform analytics that provide guests with personalized offers and content; show targeted advertisements on media; optimize Hilton's websites and mobile apps; perform analytics that improve business operations; share that data with advertising networks who serve personalized advertisements; and detect and prevent fraud.
Supporting quotations
Session ID
We collect this information in order to:
Perform analytics in order to provide guests with personalized offers and content
Show you targeted advertisements on media
Optimize our websites and mobile apps
Perform analytics to improve business operations
Share that data with advertising networks who serve personalized advertisements
Detect and prevent fraud
Qualifications & exceptions
The point-of-collection list states purposes, not the recipients of the data.
Data Access & Collection · Company practice
Point of collection, logged-in browsing: customer ratings and survey responses
Within the logged-in browsing list, customer ratings and survey responses are collected in order to troubleshoot and resolve website issues and to improve the customer experience.
Supporting quotations
Customer ratings and survey responses
We collect this personal information in order to:
Troubleshoot and resolve website issues
Improve customer experience
Qualifications & exceptions
The point-of-collection list states purposes, not the recipients of the data.
Data Access & Collection · Company practice
Point of collection, logged-in browsing: free form textual feedback
Within the logged-in browsing list, free form textual feedback is collected in order to troubleshoot and resolve website issues and to improve the customer experience.
Supporting quotations
Free form textual feedback
We collect this personal information in order to:
Troubleshoot and resolve website issues
Improve customer experience
Qualifications & exceptions
The point-of-collection list states purposes, not the recipients of the data.
Data Access & Collection · Company practice
Point of collection, logged-in browsing: Hilton Honors number and its purposes
Within the logged-in browsing list, the Hilton Honors number is collected in order to: look up and verify the member's Hilton Honors account and reservation; fulfill guest reservations; send guests communications relating to their reservations; administer membership and activity in the loyalty program; support marketing efforts; provide customer service and support; troubleshoot and resolve website issues; send marketing communications by email, direct mail and social media; perform analytics that provide guests with personalized offers and content; perform analytics that improve business operations; determine guests' eligibility for special or promotional rates; process payments; process transactions with partners; administer contests and sweepstakes; and detect and prevent fraud.
Supporting quotations
Hilton Honors number
We collect this personal information in order to:
Look up and verify your Hilton Honors account and reservation
Fulfill guest reservations
Send guests communications relating to their reservations
Administer membership and activity in the Hilton Honors loyalty program
Support marketing efforts
Provide customer service and support
Troubleshoot and resolve website issues
Send marketing communications via email, direct mail, and social media
Perform analytics in order to provide guests with personalized offers and content
Perform analytics to improve business operations
Determine guests’ eligibility for special or promotional rates
Process payments
Process transactions with partners
Administer contests and sweepstakes
Qualifications & exceptions
This is the point-of-collection list of purposes; the general collection summary in the same document states the same uses for the 12 months before August 31, 2026.
Marketing and marketing communications appear here among the purposes of collecting the loyalty number.
Data Access & Collection · Company practice
Point of collection, making a reservation: tier, purposes and the categories collected
The point-of-collection notice for making a reservation starts with the member's Hilton Honors tier, collected in order to support marketing efforts, provide customer service and troubleshoot and resolve website issues, and then states that when a reservation is made at a Hilton property, Hilton collects the following categories of personal information, used for the following purposes. The categories and purposes are set out in the rest of this section. The tier is the first item in the list, so a reservation records the member's loyalty status as well as the booking details.
Supporting quotations
Detect and prevent fraud
Hilton Honors tier
We collect this personal information in order to:
Support marketing efforts
Provide customer service
Troubleshoot and resolve website issues
Making a Reservation
When you make a reservation at a Hilton property, we collect the following categories of personal information about you, which are used for the following purposes:
Qualifications & exceptions
The notice covers reservations at a Hilton property made through this channel; other booking channels and their own notices are separate.
The remaining categories of the list are set out in the following parts of the section.
Data Access & Collection · Company practice
Point of collection, reservation: name and its purposes
In the reservation list, the guest's name is collected in order to: look up and verify the reservation; fulfill the reservation; send communications relating to the reservation; administer membership and activity in the Hilton Honors loyalty program; provide customer service and support; and send marketing communications by email and direct mail. The remaining purposes of this category are set out in the next part of the list.
Supporting quotations
Name
We collect this information in order to:
Look up and verify your reservation
Fulfill your reservation
Send you communications relating to your reservation
Administer membership and activity in the Hilton Honors loyalty program
Provide customer service and support
Send you marketing communications via email and direct mail
Qualifications & exceptions
Marketing by email and direct mail is a stated purpose of the name in the reservation list, subject to the marketing choices the Statement sets out.
Data Access & Collection · Company practice
Point of collection, reservation: name — analytics, payments and sharing
The remaining stated purposes for the name in the reservation list are: performing analytics that provide guests with personalized offers and content; performing analytics that improve business operations; determining eligibility for special or promotional rates; processing payments; processing transactions with partners; administering contests and sweepstakes; optimizing Hilton's websites and mobile apps; and detecting and preventing fraud. The Statement also says the information is shared with Hilton Principal, Hilton's Third-Party Partner, Hilton Partner Accommodations and Hilton's Third-Party Operator.
Supporting quotations
Perform analytics to provide guests with personalized offers and content
Perform analytics to improve business operations
Determine your eligibility for special or promotional rates
Process payments
Process transactions with partners
Share this information with Hilton Principal, Hilton’s Third-Party Partner Hilton Partner Accommodations, and Hilton’s Third-Party Operator
Administer contests and sweepstakes
Optimize our websites and mobile apps
Detect and prevent fraud
Qualifications & exceptions
The sharing line for this category names the recipients; it does not state a legal basis.
The point-of-collection list covers the reservation journey, not the 12-month retrospective summary.
Data Access & Collection · Company practice
Point of collection, reservation: additional names
In the reservation list, additional names are collected in order to fulfill the reservation, and the Statement says the information is shared with Hilton Partner Accommodations and Hilton's Third-Party Operator. These are the names of other guests on the booking, so the collection concerns other individuals as well as the person making the reservation.
Supporting quotations
Additional names
We collect this information in order to:
Fulfill your reservation
Share this information with Hilton Partner Accommodations and Hilton's Third-Party Operator
Qualifications & exceptions
The sharing line names the recipients for this category.
Data Access & Collection · Company practice
Point of collection, reservation: Hilton Honors number and its purposes and sharing
In the reservation list, the Hilton Honors number is collected in order to: look up and verify the member's Hilton Honors account and reservation; administer the member's Hilton Honors membership; fulfill guest reservations; send guests communications relating to their reservations; provide customer service and support; send marketing communications by email, direct mail and social media; perform analytics that provide guests with personalized offers and content; perform analytics that improve business operations; determine guests' eligibility for special or promotional rates; process payments; process transactions with partners; administer contests and sweepstakes; and detect and prevent fraud. The information is shared with Hilton Principal, Hilton Partner Accommodations and Hilton's Third-Party Operator.
Supporting quotations
Hilton Honors number
We collect this personal information in order to:
Look up and verify your Hilton Honors account and reservation
Administer your membership in Hilton Honors
Fulfill guest reservations
Send guests communications relating to their reservations
Provide customer service and support
Send marketing communications via email, direct mail, and social media
Perform analytics in order to provide guests with personalized offers and content
Perform analytics to improve business operations
Determine guests’ eligibility for special or promotional rates
Process payments
Process transactions with partners
Share this information with Hilton Principal, Hilton Partner Accommodations and Hilton’s Third-Party Operator
Administer contests and sweepstakes
Detect and prevent fraud
Qualifications & exceptions
The sharing line for this category names the recipients.
Marketing communications are a stated purpose of collecting the loyalty number in the reservation list.
Data Access & Collection · Company practice
Point of collection, reservation: phone number, its purposes and sharing
In the reservation list, the phone number is collected in order to: verify identity; fulfill the reservation; send text messages relating to check-in and any services needed during the stay; send marketing communications by SMS; provide customer service and support; perform analytics that provide personalized offers and content; perform analytics that improve business operations; process transactions with partners; detect and prevent fraud; and engage in sales activity for group bookings, meetings and events. The information is shared with Hilton Principal, Hilton's Third-Party Partner, Hilton Partner Accommodations and Hilton's Third-Party Operator.
Supporting quotations
Phone number
We collect this information in order to:
Verify identity
Fulfill your reservation
Send you text messages relating to check-in and any services you may need during your stay
Send marketing communications via SMS
Provide customer service and support
Perform analytics in order to provide you with personalized offers and content
Perform analytics to improve business operations
Process transactions with partners
Share this information with Hilton Principal, Hilton’s Third-Party Partner, Hilton Partner Accommodations, and Hilton’s Third-Party Operator
Detect and prevent fraud
Engage in sales activity for group bookings, meetings and events
Qualifications & exceptions
Text messages about check-in and in-stay services are a service use, distinct from SMS marketing, which is a separate listed purpose.
The sharing line for this category names the recipients.
Data Access & Collection · Company practice
Point of collection, reservation: address, its purposes and sharing
In the reservation list, the address is collected in order to: administer the member's membership in the Hilton Honors loyalty program; verify the member's Hilton Honors account; send communications relating to Hilton Honors; send marketing communications; perform analytics that provide personalized offers and content; perform analytics that improve business operations; determine eligibility for special or promotional rates; process payments; process transactions with partners; and detect and prevent fraud. The information is shared with Hilton Principal, Hilton's Third-Party Partner, Hilton Partner Accommodations and Hilton's Third-Party Operator.
Supporting quotations
Address
We collect this information in order to:
Administer your membership in the Hilton Honors loyalty program
Verify your Hilton Honors account
Send you communications relating to Hilton Honors
Send you marketing communications
Perform analytics in order to provide you with personalized offers and content
Perform analytics to improve business operations
Determine your eligibility for special or promotional rates
Process payments
Process transactions with partners
Share this information with Hilton Principal, Hilton’s Third-Party Partner, Hilton Partner Accommodations, and Hilton’s Third-Party Operator
Detect and prevent fraud
Qualifications & exceptions
The sharing line for this category names the recipients.
Marketing communications are a stated purpose of collecting the address in the reservation list.
Data Access & Collection · Company practice
Point of collection, reservation: address type (home/work)
In the reservation list, the address type — whether the address is a home or work address — is collected in order to perform analytics that provide personalized offers and content. The information is shared with Hilton Principal, Hilton Partner Accommodations and Hilton's Third-Party Operator.
Supporting quotations
Address type (home/work)
We collect this information in order to:
Perform analytics in order to provide you with personalized offers and content
Share this information with Hilton Principal, Hilton Partner Accommodations and Hilton’s Third-Party Operator
Qualifications & exceptions
This is the only stated purpose for the address type in the reservation list.
The sharing line for this category names the recipients.
Data Access & Collection · Company practice
Point of collection, reservation: email address and its purposes
In the reservation list, the email address is collected in order to: administer the member's membership in the Hilton Honors loyalty program; verify the member's Hilton Honors account; associate the reservation with the member's Hilton Honors account; send communications relating to Hilton Honors; send marketing communications; perform analytics that provide personalized offers and content; perform analytics that improve business operations; determine eligibility for special or promotional rates; and process transactions with partners. The sharing statement for this category follows in the next part of the list.
Supporting quotations
Email address
We collect this information in order to:
Administer your membership in the Hilton Honors loyalty program
Verify your Hilton Honors account
Associate your reservation with your Hilton Honors account
Send you communications relating to Hilton Honors
Send you marketing communications
Perform analytics in order to provide you with personalized offers and content
Perform analytics to improve business operations
Determine your eligibility for special or promotional rates
Process transactions with partners
Qualifications & exceptions
Associating the reservation with the Honors account is a stated purpose, so a booking made without logging in can still be linked to the account.
Only the first purposes of this category are stated in this part of the list.
Data Access & Collection · Company practice
Point of collection, reservation: email address — sharing, fraud, mobile authentication and group sales
The reservation list completes the email address category: the information is shared with Hilton Principal, Hilton's Third-Party Partner, Hilton Partner Accommodations and Hilton's Third-Party Operator, and the further stated purposes are detecting and preventing fraud, authenticating a mobile account, and engaging in sales activity for group bookings, meetings and events.
Supporting quotations
Share this information with Hilton Principal, Hilton’s Third-Party Partner, Hilton Partner Accommodations, and Hilton’s Third-Party Operator
Detect and prevent fraud
Authenticate mobile account
Engage in sales activity for group bookings, meetings, and events
Qualifications & exceptions
The sharing line names the recipients for this category.
Data Access & Collection · Company practice
Point of collection, reservation: preferred language
In the reservation list, the preferred language is collected in order to: provide a superior guest experience; send communications relating to Hilton Honors; send marketing communications; perform analytics that provide personalized offers and content; and is shared with Hilton Principal, Hilton's Third-Party Partner, Hilton Partner Accommodations and Hilton's Third-Party Operator. Unlike the general collection summary, this entry has no separate fraud-prevention or business-analytics line.
Supporting quotations
Preferred language
We collect this information in order to:
Provide you with a superior guest experience
Send you communications relating to Hilton Honors
Send you marketing communications
Perform analytics in order to provide you with personalized offers and content
Share this information with Hilton Principal, Hilton’s Third-Party Partner, Hilton Partner Accommodations, and Hilton’s Third-Party Operator
Qualifications & exceptions
The sharing line names the recipients for this category.
Data Access & Collection · Company practice
Point of collection, reservation: payment card information
In the reservation list, payment card information is collected in order to process payments, and it is shared with Hilton Principal, Hilton Partner Accommodations and Hilton's Third-Party Operator. The further stated purpose is detecting and preventing fraud. No sale or marketing purpose is listed for card data in this entry.
Supporting quotations
Payment card information
We collect this information in order to:
Process payments
Share this information with Hilton Principal, Hilton Partner Accommodations, and Hilton’s Third-Party Operator
Detect and prevent fraud
Qualifications & exceptions
The sharing line names the recipients for this category.
Data Access & Collection · Company practice
Point of collection, reservation: room preference
In the reservation list, the room preference is collected in order to: fulfill the reservation; personalize the guest's experience; perform analytics that provide personalized offers and content; perform analytics that improve business operations; and is shared with Hilton Principal, Hilton Partner Accommodations and Hilton's Third-Party Operator.
Supporting quotations
Room preference
We collect this information in order to:
Fulfill your reservations
Personalize your experience
Perform analytics to provide you with personalized offers and content
Perform analytics to improve business operations
Share this information with Hilton Principal, Hilton Partner Accommodations, and Hilton’s Third-Party Operator
Qualifications & exceptions
The sharing line names the recipients for this category.
Data Access & Collection · Company practice
Point of collection, reservation: corporate name and number
In the reservation list, the corporate name and number are collected in order to: fulfill the reservation; determine eligibility for special or promotional rates; and are shared with Hilton's Third-Party Partner. No marketing or analytics purpose is listed for this category in the reservation notice.
Supporting quotations
Corporate name and number
We collect this information in order to:
Fulfill your reservation
Determine your eligibility for special or promotional rates
Share this information with Hilton’s Third-Party Partner
Qualifications & exceptions
The sharing line names the recipient for this category.
Data Access & Collection · Company practice
Point of collection, reservation: travel agent name and number
In the reservation list, the travel agent's name and number are collected in order to: fulfill the reservation; determine eligibility for special or promotional rates; properly attribute reservations to travel agents; and are shared with Hilton's Third-Party Partner. The attribution purpose is a commercial one: the agent's identity credits the booking.
Supporting quotations
Travel agent name and number
We collect this information in order to:
Fulfill your reservation
Determine your eligibility for special or promotional rates
Properly attribute reservations to travel agents
Share this information with Hilton’s Third-Party Partner
Qualifications & exceptions
The sharing line names the recipient for this category.
Data Access & Collection · Company practice
Point of collection, reservation: airline partner name and number
In the reservation list, the airline partner's name and number are collected in order to credit Points to the guest if they participate in an airline loyalty program, and are shared with Hilton's Third-Party Partner. This is the only stated purpose for the category in the reservation notice.
Supporting quotations
Airline partner name and number
We collect this information in order to:
Credit Points to you if you participate in an airline loyalty program
Share this information with Hilton’s Third-Party Partner
Qualifications & exceptions
The Points crediting purpose applies only where the guest participates in an airline loyalty program.
The sharing line names the recipient for this category.
Data Access & Collection · Company practice
Point of collection: what is collected when you enroll in Hilton Honors
The notice states that when a person enrolls in Hilton Honors, Hilton collects the following categories of personal information about them, which are used for the following purposes. The categories listed are name, phone and fax numbers, address, email address, preferred language, payment card information, room preference, corporate name and number, travel agent name and number, airline partner name and number, MyWay preferences, email subscription preferences and opt-out preferences.
Supporting quotations
Enrolling in Hilton Honors
When you enroll in Hilton Honors, we collect the following categories of personal information about you, which are used for the following purposes:
Qualifications & exceptions
This is the point-of-collection list for enrolment; the same document's general collection summary is the retrospective 12-month list.
Data Access & Collection · Company practice
Point of collection, enrolment: name, its purposes and sharing
In the enrolment list, the name is collected in order to: administer the member's membership in the Hilton Honors loyalty program; verify the Hilton Honors account; send communications relating to Hilton Honors; send marketing communications; perform analytics that provide guests with personalized offers and content; perform analytics that improve business operations; determine eligibility for special or promotional rates; process payments; process transactions with Hilton Honors affiliated partners such as Points.com and Lyft; and detect and prevent fraud. The information is shared with Hilton's Third-Party Partner, and the remaining purposes are administering contests and sweepstakes and optimizing Hilton's websites and mobile apps.
Supporting quotations
Name
We collect this information in order to:
Administer your membership in the Hilton Honors loyalty program
Verify your Hilton Honors account
Send you communications relating to Hilton Honors
Send you marketing communications
Perform analytics to provide guests with personalized offers and content
Perform analytics to improve business operations
Determine your eligibility for special or promotional rates
Process payments
Process transactions with Hilton Honors affiliated partners (such as Points.com and Lyft)
Share this information with Hilton's Third-Party Partner
Administer contests and sweepstakes
Optimize our websites and mobile apps
Detect and prevent fraud
Qualifications & exceptions
Affiliate partner transactions are named as a purpose, with Points.com and Lyft given as examples.
The sharing line names the recipient for this category.
Data Access & Collection · Company practice
Point of collection, enrolment: phone and fax numbers
In the enrolment list, phone and fax numbers are collected in order to: administer the member's membership in the Hilton Honors loyalty program; verify the Hilton Honors account; send text messages relating to check-in and any services needed during the stay; authenticate a mobile account; send service-related SMS communications; provide customer service and support; perform analytics that provide personalized offers and content; perform analytics that improve business operations; process transactions with partners; and detect and preventing fraud. The information is shared with Hilton's Third-Party Partner, and the last stated purpose is engaging in sales activity for group bookings, meetings and events.
Supporting quotations
Phone and fax numbers
We collect this information in order to:
Administer your membership in the Hilton Honors loyalty program
Verify your Hilton Honors account
Send you text messages relating to check-in and any services you may need during your stay
Authenticate mobile account
Send service-related SMS communications
Provide customer service and support
Perform analytics in order to provide you with personalized offers and content
Perform analytics to improve business operations
Process transactions with partners
Share this information with Hilton's Third-Party Partner
Detect and prevent fraud
Engage in sales activity for group bookings, meetings and events
Qualifications & exceptions
Text messages about check-in and in-stay services are service uses, distinct from the service-related SMS line and from SMS marketing listed elsewhere in this document.
The sharing line names the recipient for this category.
Data Access & Collection · Company practice
Point of collection, enrolment: address, its purposes and sharing
In the enrolment list, the address is collected in order to: administer the member's membership in the Hilton Honors loyalty program; verify the Hilton Honors account; send communications relating to Hilton Honors; send marketing communications; perform analytics that provide guests with personalized offers and content; perform analytics that improve business operations; determine eligibility for special or promotional rates; process payments; process transactions with partners; and detect and prevent fraud. The information is shared with Hilton's Third-Party Partner, and the last stated purpose is engaging in sales activity for group bookings, meetings and events.
Supporting quotations
Address
We collect this information in order to:
Administer your membership in the Hilton Honors loyalty program
Verify your Hilton Honors account
Send you communications relating to Hilton Honors
Send you marketing communications
Perform analytics to provide guests with personalized offers and content
Perform analytics to improve business operations
Determine your eligibility for special or promotional rates
Process payments
Process transactions with partners
Share this information with Hilton’s Third-Party Partner
Detect and prevent fraud
Engage in sales activity for group bookings, meetings, and events
Qualifications & exceptions
The sharing line names the recipient for this category.
Data Access & Collection · Company practice
Point of collection, enrolment: email address, first purposes
In the enrolment list, the email address is collected in order to: administer the member's membership in the Hilton Honors loyalty program; verify the member's Hilton Honors account and reservation; and associate the reservation with the member's Hilton Honors account. The remaining purposes of this category are set out in the next part of the list.
Supporting quotations
Email address
We collect this information in order to:
Administer your membership in the Hilton Honors loyalty program
Verify your Hilton Honors account and reservation
Associate your reservation with your Hilton Honors account
Qualifications & exceptions
Only the first purposes of this category are stated in this part of the list.
Data Access & Collection · Company practice
Point of collection, enrolment: email address — remaining purposes and sharing
The remaining stated purposes for the email address in the enrolment list are: sending communications relating to Hilton Honors; sending marketing communications; performing analytics that provide personalized offers and content; performing analytics that improve business operations; determining eligibility for special or promotional rates; and processing transactions with partners. The information is shared with Hilton's Third-Party Partner, and the further purposes are detecting and preventing fraud, authenticating a mobile account, and engaging in sales activity for group bookings, meetings and events.
Supporting quotations
Send you communications relating to Hilton Honors
Send you marketing communications
Perform analytics in order to provide you with personalized offers and content
Perform analytics to improve business operations
Determine your eligibility for special or promotional rates
Process transactions with partners
Share this information with Hilton's Third-Party Partner
Detect and prevent fraud
Authenticate mobile account
Engage in sales activity for group bookings, meetings and events
Qualifications & exceptions
The sharing line names the recipient for this category.
Data Access & Collection · Company practice
Point of collection, enrolment: preferred language
In the enrolment list, the preferred language is collected in order to: provide a superior guest experience; send communications relating to Hilton Honors; send marketing communications; perform analytics that provide personalized offers and content; and is shared with Hilton Principal, Hilton's Third-Party Partner, Hilton Partner Accommodations and Hilton's Third-Party Operator. Unlike the reservation list, the enrolment entry names four recipients for sharing.
Supporting quotations
Preferred language
We collect this information in order to:
Provide you with a superior guest experience
Send you communications relating to Hilton Honors
Send you marketing communications
Perform analytics in order to provide you with personalized offers and content
Share this information with Hilton Principal, Hilton’s Third-Party Partner, Hilton Partner Accommodations, and Hilton’s Third-Party Operator
Qualifications & exceptions
The sharing line names the recipients for this category.
Data Access & Collection · Company practice
Point of collection, enrolment: payment card information
In the enrolment list, payment card information is collected in order to process payments, and it is shared with Hilton Principal, Hilton Partner Accommodations and Hilton's Third-Party Operator. The further stated purpose is detecting and preventing fraud. The Statement does not list a marketing or analytics purpose for card data in this entry.
Supporting quotations
Payment card information
We collect this information in order to:
Process payments
Share this information with Hilton Principal, Hilton Partner Accommodations, and Hilton’s Third-Party Operator
Detect and prevent fraud
Qualifications & exceptions
The sharing line names the recipients for this category.
Data Access & Collection · Company practice
Point of collection, enrolment: room preference
In the enrolment list, the room preference is collected in order to: fulfill the reservation; personalize the experience; perform analytics that provide personalized offers and content; perform analytics that improve business operations; and is shared with Hilton Principal, Hilton Partner Accommodations and Hilton's Third-Party Operator.
Supporting quotations
Room preference
We collect this information in order to:
Fulfill your reservations
Personalize your experience
Perform analytics to provide you with personalized offers and content
Perform analytics to improve business operations
Share this information with Hilton Principal, Hilton Partner Accommodations, and Hilton’s Third-Party Operator
Qualifications & exceptions
The sharing line names the recipients for this category.
Data Access & Collection · Company practice
Point of collection, enrolment: corporate name and number
In the enrolment list, the corporate name and number are collected in order to: fulfill the reservation; determine eligibility for special or promotional rates; and are shared with Hilton's Third-Party Partner. No marketing or analytics purpose is listed for this category in the enrolment notice.
Supporting quotations
Corporate name and number
We collect this information in order to:
Fulfill your reservation
Determine your eligibility for special or promotional rates
Share this information with Hilton’s Third-Party Partner
Qualifications & exceptions
The sharing line names the recipient for this category.
Data Access & Collection · Company practice
Point of collection, enrolment: travel agent name and number
In the enrolment list, the travel agent's name and number are collected in order to: fulfill the reservation; determine eligibility for special or promotional rates; properly attribute reservations to travel agents; and are shared with Hilton's Third-Party Partner.
Supporting quotations
Travel agent name and number
We collect this information in order to:
Fulfill your reservation
Determine your eligibility for special or promotional rates
Properly attribute reservations to travel agents
Share this information with Hilton’s Third-Party Partner
Qualifications & exceptions
The sharing line names the recipient for this category.
Data Access & Collection · Company practice
Point of collection, enrolment: airline partner name and number
In the enrolment list, the airline partner's name and number are collected in order to credit Points to the member if they participate in an airline loyalty program, and are shared with Hilton's Third-Party Partner. This is the only stated purpose for the category in the enrolment notice.
Supporting quotations
Airline partner name and number
We collect this information in order to:
Credit Points to you if you participate in an airline loyalty program
Share this information with Hilton’s Third-Party Partner
Qualifications & exceptions
The Points crediting purpose applies only where the member participates in an airline loyalty program.
The sharing line names the recipient for this category.
Data Access & Collection · Company practice
Point of collection, enrolment: MyWay preferences
In the enrolment list, the member's MyWay preferences are collected in order to provide a superior guest experience, and are shared with Hilton's Third-Party Partner. The guest experience is the only stated purpose for this category in the enrolment notice.
Supporting quotations
MyWay preferences
We collect this information in order to:
Provide you with a superior guest experience
Share this information with Hilton’s Third-Party Partner
Qualifications & exceptions
The sharing line names the recipient for this category.
Data Access & Collection · Company practice
Point of collection, enrolment: email subscription preferences
In the enrolment list, email subscription preferences are collected in order to send the communications the member would like to receive. No sharing line is stated for this category in the enrolment notice.
Supporting quotations
Email subscription preferences
We collect this information in order to:
Send you the communications you would like to receive
Qualifications & exceptions
The stated purpose is sending requested communications, which is distinct from marketing communications listed for other categories.
Data Access & Collection · Company practice
Point of collection, enrolment: opt-out preferences
In the enrolment list, opt-out preferences are collected in order to send the communications the member would like to receive and to better serve guests. The category records the member's opt-out choices; the Statement's marketing choices section describes how those choices are exercised and withdrawn.
Supporting quotations
Opt-out preferences
We collect this information in order to:
Send you the communications you would like to receive
Better serve our guests
Qualifications & exceptions
The two stated purposes are the sending of requested communications and serving guests; no sharing line is stated for this category in the enrolment notice.
Data Access & Collection · Company practice
Point of collection: what may be collected when you check in at a Hilton property
The notice says that when a guest checks in at a Hilton property, Hilton may collect the following categories of personal information about them, which are used for the following purposes. The word used is 'may', so the collection at check-in is conditional. The categories listed are name, payment card information, additional guest names, passport or ID information, address, nationality and further items that follow in the next part of the section.
Supporting quotations
Checking in at a Hilton Property
When you check in at a Hilton property, we may collect the following categories of personal information about you, which are used for the following purposes:
Qualifications & exceptions
The check-in notice says Hilton 'may' collect these categories, so collection at check-in is not stated as automatic.
The remaining categories of the list follow in the next part of the section.
Data Access & Collection · Company practice
Point of collection, check-in: name and its purposes
In the check-in list, the guest's name is collected in order to: look up and verify the reservation; fulfill the reservation; provide customer service and support; and detect and prevent fraud. No marketing or analytics purpose is stated for the name in this entry.
Supporting quotations
Name
We collect this information in order to:
Look up and verify your reservation
Fulfill your reservation
Provide customer service and support
Detect and prevent fraud
Data Access & Collection · Company practice
Point of collection, check-in: payment card information
In the check-in list, payment card information is collected in order to process payments, and it is shared with Hilton Principal, Hilton Partner Accommodations and Hilton's Third-Party Operator. The further stated purpose is detecting and preventing fraud.
Supporting quotations
Payment card information
We collect this information in order to:
Process payments
Share this information with Hilton Principal, Hilton Partner Accommodations, and Hilton’s Third-Party Operator
Detect and prevent fraud
Qualifications & exceptions
The sharing line names the recipients for this category.
Data Access & Collection · Company practice
Point of collection, check-in: additional guest names
In the check-in list, additional guest names are collected in order to fulfill the reservation. These are the names of other people on the booking, so the collection concerns other individuals as well as the guest checking in. No sharing line is stated for this category.
Supporting quotations
Additional guest names
We collect this information in order to:
Fulfill your reservation
Data Access & Collection · Company practice
Point of collection, check-in: passport or ID information
In the check-in list, passport or ID information is collected in order to comply with applicable laws that require Hilton to collect this information in some jurisdictions. The legal trigger is global and qualified by 'some jurisdictions'; the Statement does not name the countries or the law. No sharing line is stated for this category in the check-in list.
Supporting quotations
Passport or ID information
We collect this information in order to:
Comply with applicable laws that require us to collect this information in some jurisdictions
Qualifications & exceptions
The stated basis is a legal requirement 'in some jurisdictions', not a Hilton service purpose.
The Statement does not name the specific laws or jurisdictions in this entry.
Data Access & Collection · Company practice
Point of collection, check-in: address, its purposes and sharing
In the check-in list, the address is collected in order to: comply with applicable laws that require the collection in some jurisdictions; verify the Hilton Honors account; fulfill the reservation; send communications relating to the reservation; send marketing communications; perform analytics that provide guests with personalized offers and content; perform analytics that improve business operations; process payments; process transactions with partners; and detect and prevent fraud. The information is shared with Hilton Principal, Hilton's Third-Party Partner and Hilton's Third-Party Operator.
Supporting quotations
Address
We collect this information in order to:
Comply with applicable laws that require us to collect this information in some jurisdictions
Verify your Hilton Honors account
Fulfill your reservation
Send you communications relating to your reservation
Send you marketing communications
Perform analytics to provide guests with personalized offers and content
Perform analytics to improve business operations
Process payments
Process transactions with partners
Share this information with Hilton Principal, Hilton’s Third-Party Partner, and Hilton’s Third-Party Operator
Detect and prevent fraud
Qualifications & exceptions
One stated purpose is a legal requirement 'in some jurisdictions', alongside the service and marketing purposes.
The sharing line names the recipients for this category.
Data Access & Collection · Company practice
Point of collection, check-in: nationality collected for legal compliance
In the check-in list, nationality is collected in order to comply with applicable laws that require Hilton to collect this information in some jurisdictions. This is the first stated purpose for the category; the remaining purposes and any sharing line follow in the next part of the section.
Supporting quotations
Nationality
We collect this information in order to:
Comply with applicable laws that require us to collect this information in some jurisdictions
Qualifications & exceptions
The stated basis is a legal requirement 'in some jurisdictions'.
Only the first purpose of this category is stated in this part of the list.
Data Access & Collection · Company practice
Point of collection, check-in: date of birth collected for legal compliance
In the check-in list, date of birth is collected in order to comply with applicable laws that require Hilton to collect this information in some jurisdictions. The legal trigger is qualified by 'some jurisdictions'; the Statement does not name the specific laws here.
Supporting quotations
Date of birth
We collect this information in order to:
Comply with applicable laws that require us to collect this information in some jurisdictions
Qualifications & exceptions
The stated basis is a legal requirement 'in some jurisdictions', not a Hilton service purpose.
Only the first purpose of this category is stated in this part of the list.
Data Access & Collection · Company practice
Point of collection, check-in: gender collected for legal compliance
In the check-in list, gender is collected in order to comply with applicable laws that require Hilton to collect this information in some jurisdictions. The legal trigger is qualified by 'some jurisdictions'; the Statement does not name the specific laws here.
Supporting quotations
Gender
We collect this information in order to:
Comply with applicable laws that require us to collect this information in some jurisdictions
Qualifications & exceptions
The stated basis is a legal requirement 'in some jurisdictions', not a Hilton service purpose.
Only the first purpose of this category is stated in this part of the list.
Data Access & Collection · Company practice
Point of collection, check-in: Hilton Honors number and its purposes
In the check-in list, the Hilton Honors number is collected in order to: look up and verify the member's Hilton Honors account and reservation; administer the member's Hilton Honors membership; support marketing efforts; provide customer service and support; fulfill guest reservations; send guests communications relating to their reservations; send marketing communications by email, direct mail and social media; perform analytics that provide guests with personalized offers and content; perform analytics that improve business operations; determine guests' eligibility for special or promotional rates; process payments; and process transactions with partners. The remaining purposes of this category are set out in the next part of the list.
Supporting quotations
Hilton Honors number
We collect this personal information in order to:
Look up and verify your Hilton Honors account and reservation
Administer your membership in Hilton Honors
Support marketing efforts
Provide customer service and support
Fulfill guest reservations
Send guests communications relating to their reservations
Send marketing communications via email, direct mail, and social media
Perform analytics in order to provide guests with personalized offers and content
Perform analytics to improve business operations
Determine guests’ eligibility for special or promotional rates
Process payments
Qualifications & exceptions
Marketing and marketing communications are stated purposes of collecting the loyalty number at check-in.
Only the first purposes of this category are stated in this part of the list.
Data Access & Collection · Company practice
Point of collection, check-in: Hilton Honors number — remaining purposes and sharing
The remaining stated purposes for the Hilton Honors number in the check-in list are processing transactions with partners, administering contests and sweepstakes, and detecting and preventing fraud. The information is shared with Hilton Principal, Hilton's Third-Party Partner and Hilton's Third-Party Operator.
Supporting quotations
Process transactions with partners
Administer contests and sweepstakes
Share this information with Hilton Principal, Hilton’s Third-Party Partner, and Hilton’s Third-Party Operator
Detect and prevent fraud
Qualifications & exceptions
The sharing line names the recipients for this category.
Data Access & Collection · Company practice
Point of collection, check-in: frequent flyer number to award loyalty Points
In the check-in list, the frequent flyer number is collected in order to facilitate the award of loyalty Points. That is the only stated purpose for the category in the check-in notice.
Supporting quotations
Frequent flyer number
We collect this information in order to:
Facilitate the award of loyalty Points
Data Access & Collection · Company practice
Point of collection, check-in: email address, its purposes and sharing
In the check-in list, the email address is collected in order to: send folios after the completion of a stay; associate the reservation with the member's Hilton Honors account; send marketing communications; perform analytics that provide personalized offers and content; perform analytics that improve business operations; determine eligibility for special or promotional rates; and process transactions with partners. The information is shared with Hilton Principal, Hilton's Third-Party Partner and Hilton's Third-Party Operator, and the further purposes are detecting and preventing fraud, authenticating a mobile account, and engaging in sales activity for group bookings, meetings and events.
Supporting quotations
Email address
We collect this information in order to:
Send folios after the completion of a stay
Associate your reservation with your Hilton Honors account
Send you marketing communications
Perform analytics in order to provide you with personalized offers and content
Perform analytics to improve business operations
Determine your eligibility for special or promotional rates
Process transactions with partners
Share this information with Hilton Principal, Hilton’s Third-Party Partner, and Hilton’s Third-Party Operator
Detect and prevent fraud
Authenticate mobile account
Engage in sales activity for group bookings, meetings and events
Qualifications & exceptions
Sending folios after the stay is a service use, distinct from the marketing and analytics purposes listed alongside it.
The sharing line names the recipients for this category.
Data Access & Collection · Company practice
Point of collection: what is collected when you check in using e-check-in
The notice says that when a guest checks in using e-check-in, Hilton collects the following categories of personal information about them, which are used for the following purposes. The categories listed are payment card information, room selection and assignment, arrival time and departure date. E-check-in is a self-service check-in route, so the same stay-related data is collected without the front desk.
Supporting quotations
E-Check In
When you check in using e-check-in, we collect the following categories of personal information about you, which are used for the following purposes:
Qualifications & exceptions
The notice says Hilton 'collects', not 'may collect', for e-check-in; the check-in notice itself says 'may collect'.
The remaining categories of the list, if any, follow in the next part of the section.
Data Access & Collection · Company practice
Point of collection, e-check-in: payment card information
In the e-check-in list, payment card information is collected in order to: receive payment for the reservation; detect and prevent fraud; and maintain books and records and comply with legal obligations for business reporting, auditing, tax and income reconciliation. No sharing line is stated for this category in the e-check-in list.
Supporting quotations
Payment card information
We collect this information in order to:
Receive payment for your reservation
Detect and prevent fraud
Maintain books and records and comply with legal obligations for business reporting, auditing, tax, and income reconciliation
Qualifications & exceptions
The record-keeping purpose is tied to legal obligations for business reporting, auditing, tax and income reconciliation.
Data Access & Collection · Company practice
Point of collection, e-check-in: room selection and assignment
In the e-check-in list, room selection and assignment is collected in order to fulfill the reservation and to better serve guests. These are the only stated purposes for the category in the e-check-in notice.
Supporting quotations
Room selection and assignment
We collect this information in order to:
Fulfill your reservation
Better serve our guests
Data Access & Collection · Company practice
Point of collection, e-check-in: arrival time
In the e-check-in list, arrival time is collected in order to: better serve guests; fulfill the reservation; personalize the experience; and provide customer service and support. No sharing line is stated for this category in the e-check-in list.
Supporting quotations
Arrival time
We collect this information in order to:
Better serve our guests
Fulfill your reservation
Personalize your experience
Provide customer service and support
Data Access & Collection · Company practice
Point of collection, e-check-in: departure date
In the e-check-in list, departure date is collected in order to: better serve guests; fulfill the reservation; personalize the experience; and provide customer service and support. No sharing line is stated for this category in the e-check-in list.
Supporting quotations
Departure date
We collect this information in order to:
Better serve our guests
Fulfill your reservations
Personalize your experience
Provide customer service and support
Data Access & Collection · Company practice
Point of collection: what is collected when you use Digital Key
The notice says that when a guest uses Digital Key, Hilton collects the following categories of personal information about them, which are used for the following purposes. The categories listed are payment card information, room selection and assignment, arrival time, departure date and precise geolocation information. Digital Key is the phone-based room access feature, and its notice adds precise geolocation to the stay categories.
Supporting quotations
Digital Key
When you use Digital Key, we collect the following categories of personal information about you, which are used for the following purposes:
Qualifications & exceptions
Digital Key use is what triggers the collection described here.
The remaining categories of the list follow in the next part of the section.
Data Access & Collection · Company practice
Point of collection, Digital Key: payment card information
In the Digital Key list, payment card information is collected in order to: receive payment for the reservation; detect and prevent fraud; and maintain books and records and comply with legal obligations for business reporting, auditing, tax and income reconciliation. No sharing line is stated for this category in the Digital Key list.
Supporting quotations
Payment card information
We collect this information in order to:
Receive payment for your reservation
Detect and prevent fraud
Maintain books and records and comply with legal obligations for business reporting, auditing, tax, and income reconciliation
Qualifications & exceptions
The record-keeping purpose is tied to legal obligations for business reporting, auditing, tax and income reconciliation.
Data Access & Collection · Company practice
Point of collection, Digital Key: room selection and assignment
In the Digital Key list, room selection and assignment is collected in order to fulfill the reservation and to better serve guests. These are the only stated purposes for the category in the Digital Key notice.
Supporting quotations
Room selection and assignment
We collect this information in order to:
Fulfill your reservation
Better serve our guests
Data Access & Collection · Company practice
Point of collection, Digital Key: arrival time
In the Digital Key list, arrival time is collected in order to: better serve guests; fulfill the reservation; personalize the experience; and provide customer service and support. No sharing line is stated for this category in the Digital Key list.
Supporting quotations
Arrival time
We collect this information in order to:
Better serve our guests
Fulfill your reservation
Personalize your experience
Provide customer service and support
Data Access & Collection · Company practice
Point of collection, Digital Key: departure date
In the Digital Key list, departure date is collected in order to: better serve guests; fulfill the reservation; personalize the experience; and provide customer service and support. No sharing line is stated for this category in the Digital Key list.
Supporting quotations
Departure date
We collect this information in order to:
Better serve our guests
Fulfill your reservations
Personalize your experience
Provide customer service and support
Data Access & Collection · Company practice
Point of collection, Digital Key: precise geolocation information
In the Digital Key list, precise geolocation information is collected in order to: enable the guest to access the guest room and hotel facilities; fulfill Digital Key sharing requests; and detect and prevent fraud. This is the only category in the point-of-collection notices described as 'precise geolocation information'.
Supporting quotations
Precise geolocation information
We collect this information in order to:
Enable you to access your guest room and hotel facilities
Fulfill Digital Key sharing requests
Detect and prevent fraud
Qualifications & exceptions
The category is stated in the Digital Key notice only; the general collection summary has a separate 'Geolocation information' category collected from browsing and app use.
No sharing line is stated for this category in the Digital Key list.
Data Access & Collection · Company practice
Point of collection: what is collected when you contact Guest Assistance
The notice says that when a person contacts Guest Assistance, Hilton collects the following categories of personal information about them, which are used for the following purposes. The first category is complaint descriptions, with purposes that follow in the next part of the section. The categories after that are name, address, email address, phone and fax numbers, as the section shows.
Supporting quotations
Guest Assistance
When you contact Guest Assistance, we collect the following categories of personal information about you, which are used for the following purposes:
Qualifications & exceptions
This notice covers contact with Guest Assistance, not the general customer service channels.
Data Access & Collection · Company practice
Point of collection, Guest Assistance: complaint descriptions
In the Guest Assistance list, complaint descriptions are collected in order to: respond to the complaint or injury; perform analytics to improve business operations; and provide customer service and support. The remaining purposes of this category, and any sharing line, follow in the next part of the section.
Supporting quotations
Complaint descriptions
We collect this information in order to:
Respond to your complaint or injury
Perform analytics to improve business operations
Provide customer service and support
Qualifications & exceptions
The purposes cover both complaints and injuries reported through Guest Assistance.
Only the first purposes of this category are stated in this part of the list.
Data Access & Collection · Company practice
Point of collection, Guest Assistance: name, identity verification and record search
In the Guest Assistance list, the name is collected in order to: look up and verify identity; search Hilton's records for information about past stays and membership in the Hilton Honors loyalty program; provide customer service recovery and support; and detect and prevent fraud. The record-search purpose means the name is used to pull the person's history with Hilton, not only to answer the current request. No sharing line is stated for this category in the Guest Assistance notice.
Supporting quotations
Name
We collect this information in order to:
Look up and verify your identity
Search our records for information about your past stays and membership in the Hilton Honors loyalty program
Provide customer service recovery and support
Detect and prevent fraud
Qualifications & exceptions
The sharing grounds are qualified: law enforcement, employer sharing on corporate agreements and employee consent, and franchise owners only where the incident relates to their property.
Data Access & Collection · Company practice
Point of collection, Guest Assistance: address
In the Guest Assistance list, the address is collected in order to: verify identity; provide customer service and support; and detect and prevent fraud. No sharing line is stated for this category in the Guest Assistance notice.
Supporting quotations
Address
We collect this information in order to:
Verify your identity
Provide customer service and support
Detect and prevent fraud
Data Access & Collection · Company practice
Point of collection, Guest Assistance: email address
In the Guest Assistance list, the email address is collected in order to: verify identity; provide follow-up communications regarding the inquiry; perform analytics to improve business operations; detect and prevent fraud; provide customer service and support; and authenticate a mobile account. No sharing line is stated for this category in the Guest Assistance notice.
Supporting quotations
Email address
We collect this information in order to:
Verify your identity
Provide follow-up communications regarding your inquiry
Perform analytics to improve business operations
Detect and prevent fraud
Provide customer service and support
Authenticate mobile account
Data Access & Collection · Company practice
Point of collection, Guest Assistance: phone and fax numbers
In the Guest Assistance list, phone and fax numbers are collected in order to: verify identity; provide follow-up communications regarding the inquiry; authenticate a mobile account; send service-related SMS communications; provide customer service and support; and detect and prevent fraud. No sharing line is stated for this category in the Guest Assistance notice.
Supporting quotations
Phone and fax numbers
We collect this information in order to:
Verify your identity
Provide follow-up communications regarding your inquiry
Authenticate mobile account
Send service-related SMS communications
Provide customer service and support
Detect and prevent fraud
Data Access & Collection · Restriction or exception
Minors: no knowing collection below the age of majority without parental permission, and ages of minor guests for rates
Hilton states that it does not knowingly collect, disclose or sell personal information of individuals under the age of majority in their respective jurisdiction without permission from a minor's parent or guardian, and that it verifies parental or guardian consent using industry-standard methods before collecting, processing or storing a minor's personal information. It adds that when searching for hotel reservations on a Hilton website or in the Hilton Honors app, a guest may be asked for the ages of minor guests staying in the room, and that Hilton collects this to determine room rates where applicable, such as at an all-inclusive property. The age of majority is therefore jurisdictional, and the age-of-guests collection is a specific rate-determination use.
Supporting quotations
Minors
Hilton does not knowingly collect, disclose, or sell personal information of individuals under the age of majority in their respective jurisdiction without permission from a minor’s parent or guardian.
We verify parental or guardian consent using industry-standard methods prior to collecting, processing, or storing personal information of minors.
Hilton collects this information for the purpose of determining room rates where applicable, such as at an “all-inclusive” property.
Qualifications & exceptions
The age threshold is 'the age of majority in their respective jurisdiction', so it differs by country and is not a single stated age.
The consent verification is described as using industry-standard methods; the Statement does not name them.
The ages of minor guests are requested to determine room rates where applicable, for example at an all-inclusive property.
Retention & Deletion · Company practice
CCTV: footage retained 31 days, access requests handled by the Data Protection Office or the franchise hotel
Hilton states that it uses closed-circuit television and other security measures at its properties which may capture or record images of guests and visitors in clearly signposted public areas such as hallways and lobbies, and that it does not use them in areas where guests and visitors have a reasonable expectation of privacy, such as locker rooms and bathrooms. It retains CCTV footage on property and in the cloud for 31 days unless it is required to maintain footage for longer, for example where the footage is subject to a legal proceeding or investigation, and it protects footage under its information security policies. A person may be able to request access to CCTV footage within the time specified by applicable law and as required by law. For franchised hotels, which are operated by separate entities, access requests go to that hotel, and those entities are also independent data controllers of CCTV images; where the law permits, Hilton may charge a fee to cover the cost of responding.
Supporting quotations
Closed-Circuit Television (CCTV)
We do not use CCTV and other security measures in areas where guests and visitors have a reasonable expectation of privacy, such as locker rooms and bathrooms.
We retain CCTV footage on property and in the cloud for 31 days unless we are required to maintain footage for a longer period, such as if the footage is subject to a legal proceeding or investigation.
You may be able to request access to CCTV footage within the time specified by applicable law and as required by law.
To request access to CCTV images from a franchised hotel, please contact that hotel.
In addition to Hilton Domestic Operating Company Inc., those entities also are independent data controllers of CCTV images.
When permitted by law, we may charge an appropriate fee to cover the costs of responding to the request.
Qualifications & exceptions
The 31-day retention is a default: footage may be kept longer where a legal proceeding or investigation requires it.
Access to footage is possible only within the time specified by applicable law and as required by law.
The franchise disclosure and the possible access fee are separate from Hilton's own retention commitment.
CCTV recording is described as confined to signposted public areas and as not used in areas of reasonable expectation of privacy.
Data Access & Collection · Company practice
Cookies and Other Technologies: what they are, what they are used for, and consent for non-essential cookies
Hilton says that, like many other websites, its site may use 'Cookies' or 'Other Technologies' — pixel tags, web beacons, clear GIFs, links in emails, JavaScript, device IDs assigned by Google or Apple or similar technologies — which allow Hilton and third parties to obtain information about visits to the site, including to analyse visiting patterns. Hilton uses this information to process reservations or requests and to deliver online and mobile advertisements, messages and content for Hilton and others that are specific to the visitor's interests. Depending on the jurisdiction, prior consent for the use of non-essential cookies may be required, and if it is, Hilton says it will obtain consent before using cookies on the device. Cookies are small text files stored on the visitor's computer or mobile device; a cookie alone cannot disclose individual identity, though Hilton may tie its own or third-party cookies to personal information it holds or has otherwise obtained.
Supporting quotations
3. Online and Mobile Information We Collect
Cookies and Other Technologies
our site may use "Cookies" or "Other Technologies"
Depending on your jurisdiction, prior consent for the use of non-essential cookies may be required.
Cookies are small text files that are stored on your computer or mobile device
Cookies alone cannot be used to disclose your individual identity to us, though in some cases we may tie Hilton or third-party Cookies to personal information you have provided to us or that we have otherwise obtained about you.
Qualifications & exceptions
'May use' states a possibility, not that every technology is used on every visit.
The consent requirement is qualified by 'depending on your jurisdiction' and applies to non-essential cookies.
Cookies alone cannot disclose identity, but they may be linked to personal information Hilton already holds.
Use & Processing · Company practice
Examples of what Hilton uses cookies for
Hilton lists what it uses cookies for: remembering the user name and password so that log-in is easier and faster on future visits; remembering language and other preferences; ensuring the visitor obtains all requested information; providing a safe and secure service for online transactions; tracking the visitor's response to advertisements and to website or app content, for analysis and for the number of times the same advertisement is sent; measuring how many people use the site and how they use it so it can keep running quickly and efficiently; and helping Hilton and others deliver communications and content that are relevant and responsive to the visitor's interests and location.
Supporting quotations
For example, we will use Cookies to:
Remember your user name and password for future visits so that log-in is easier and faster;
Remember your language and other preferences;
Ensure you obtain all requested information;
Provide a safe and secure service for online transactions;
Track your response to advertisements and website or app content for analysis and the number of times we send you the same advertisement;
Measure how many people use the site, and how they use it, so that we may keep it running quickly and efficiently; and
Help us and others deliver communications and content to you that are relevant and responsive to your interests and location.
Qualifications & exceptions
The list is introduced with 'For example', so it is illustrative rather than exhaustive.
Remembering the user name and password means login credentials can be held on the device for later visits.
Use & Processing · Company practice
Essential and Functional cookies
Hilton explains the cookie types that may be used on the site. Essential Cookies are necessary for the site to work and enable the visitor to move around it and use its services and features; disabling them may make those services and features unavailable. Functional Cookies save the visitor's settings on the site, such as language preference or booking information previously used, and store things such as the last hotel searched for so it is easy to find on a later visit; some Functional Cookies are essential to viewing maps or videos on the site.
Supporting quotations
Below we explain the different types of Cookies that may be used on the site.
Essential Cookies – Essential Cookies are necessary for the site to work, and enable you to move around it and use its services and features. Disabling these Cookies may make the services and features unavailable.
Functional Cookies – We use Functional Cookies to save your settings on the site—settings such as your language preference, or booking information you have previously used when booking a hotel with us.
Qualifications & exceptions
Essential cookies are described as necessary for the site to work; disabling them may remove services and features.
Some Functional Cookies are described as essential to viewing maps or videos.
The list is of cookie types 'that may be used', not a statement that all are always set.
Retention & Deletion · Company practice
Session and Persistent cookies
Session Cookies are stored only temporarily during a browsing session and are deleted from the device when the browser is closed; Hilton uses them to support site functionality and to understand use of the site — which pages are visited, which links are used and how long the visitor stays on each page. Persistent Cookies are not deleted when the browser is closed but are saved on the device for a fixed period or until the visitor deletes them; the server that set the cookie recognises it on each visit, and Hilton and others use persistent cookies to store preferences for the next visit, to keep a more accurate account of how often and how the site is used over time, and to measure the effectiveness of advertising efforts.
Supporting quotations
Session Cookies – These types of Cookies are stored only temporarily during a browsing session, and are deleted from your device when you close the browser.
We use Session Cookies to support the functionality of the site and to understand your use of the site
Persistent Cookies – These types of Cookies are not deleted when you close your browser, but are saved on your device for a fixed period of time or until you delete them.
We and others use persistent Cookies to store your preferences, so that they are available for your next visit, to keep a more accurate account of how often you visit the site, how often you return, how your use of the site may vary over time and the effectiveness of advertising efforts.
Qualifications & exceptions
Session cookies last only for the browsing session and are deleted when the browser closes.
Persistent cookies last for a fixed period or until the visitor deletes them.
Persistent cookies are used to measure visit frequency and advertising effectiveness over time.
Use & Processing · Company practice
Advertising cookies and Social Plug-In cookies
Advertising Cookies allow Hilton and other advertisers to show the most relevant products, offers and advertisements on the site, on third-party sites, or through emails and other message platforms; some of them help service providers and other advertisers select advertisements based on interests expressed or inferred from visits to Hilton's websites or apps, or across other websites, online services and apps over time, others prevent the same advertisement from reappearing continuously, and they help Hilton provide content tailored to the visitor's interests and needs. Social Plug-In Cookies are included within Advertising Cookies: they are used to share site content with members and non-members of social media networks such as Facebook, X, YouTube and Pinterest, and are usually set by the social networking provider.
Supporting quotations
Advertising Cookies – Allow us and other advertisers to show you the most relevant products, offers, and advertisements on the site and third-party sites, or through emails or other message platforms.
some Advertising Cookies help our service providers and other advertisers select advertisements that are based on your interests, including those expressed or inferred by visits to our websites or apps or across other websites, online services, and apps over time.
Social Plug-In Cookies – Advertising Cookies also include Social Plug-In Cookies.
These Cookies are usually set by the social networking provider, enabling such sharing to be smooth and seamless.
Qualifications & exceptions
Interest-based selection may be inferred from visits across other websites, online services and apps over time.
Social Plug-In Cookies are usually set by the social networking provider, not by Hilton.
The Statement notes that some Analytics Cookies and other technologies are used in part to facilitate advertising.
Data Access & Collection · Company practice
Analytics cookies and other technologies used for the same purposes
Analytics Cookies collect information about use of the site and enable Hilton to improve the way it works: they give Hilton aggregated information used to monitor site performance, count page visits, spot technical errors, see how users reach the site, and measure the effectiveness of advertising, including emails. Hilton also says other technologies may be used for the same purposes as its cookies, to allow Hilton and third parties to know when a visitor comes to the site and to understand how the visitor interacts with emails or advertisements; through these technologies, non-personal information such as operating system, browser version and the URL the visitor came from, or aggregate information, may be obtained and used to enhance the experience and understand traffic patterns.
Supporting quotations
Analytics Cookies – Collect information about your use of the site, and enable us to improve the way it works.
These Cookies give us aggregated information that we use to monitor site performance, count page visits, spot technical errors, see how users reach the site, and measure the effectiveness of advertising (including emails we send to you).
Other technologies may be used for the same purposes as our Cookies, to allow us and third parties to know when you visit the site, and to understand how you interact with emails or advertisements.
Through Other Technologies, non-personal information (e.g., your operating system, your browser version, and the URL you came from) or aggregate information may be obtained and used to enhance your experience and understand traffic patterns.
Qualifications & exceptions
The analytics cookies described give aggregated information.
Other technologies are described as yielding non-personal or aggregate information in the examples given.
Account & Service Control · User right or choice
Managing cookies: browser settings, Hilton's responsibility, and the effect of rejecting cookies
Hilton says that a visitor who wants to remove or block cookies from their device at any time can update their browser settings, consulting the browser's help menu, and that Hilton is not responsible for the visitor's browser settings. It then gives per-browser instructions. It also warns that rejecting cookies may affect the visitor's ability to perform certain transactions on the site, and Hilton's ability to recognise the browser from one visit to the next.
Supporting quotations
Managing Cookies and Other Technologies
If you want to remove or block Cookies from your device at any time, you can update your browser settings
Hilton is not responsible for your browser settings.
rejecting Cookies may affect your ability to perform certain transactions on the Site, and our ability to recognize your browser from one visit to the next.
Qualifications & exceptions
Hilton places responsibility for the setting on the visitor, not on itself.
Rejecting cookies is not cost-free: some transactions may no longer be possible and the browser may not be recognised between visits.
Account & Service Control · Procedure
Apple Safari: how to set your cookie preference
For Apple Safari, Hilton's instructions are: from the Safari app, select Preferences, then click Privacy and select the cookie preference from the provided options. The choice is made in the browser's own privacy settings.
Supporting quotations
Apple Safari
From the Safari app, select Preferences
Click Privacy and select your cookie preference from the provided options.
Account & Service Control · Procedure
Google Chrome: how to set your cookie preference
For Google Chrome, Hilton's instructions are: at the top right of the browser, click the three vertical dots to open a drop-down menu, select Settings, and then, under Privacy and security, click Tracking Protection and select the cookie preference from the provided options.
Supporting quotations
Google Chrome
At the top right of the Chrome browser, click the three vertical dots to open a drop-down menu.
Select Settings.
Under Privacy and security, click Tracking Protection, and select your cookie preference from the provided options.
Account & Service Control · Procedure
Microsoft Edge: how to set your cookie preference
For Microsoft Edge, Hilton's instructions are: at the top right of the browser, select the three dots icon to open a menu, select Settings and click Site permissions, and then click Manage and delete cookies and site data to select the cookie preference from the provided options.
Supporting quotations
Microsoft Edge
At the top right of the Microsoft Edge browser, select the three dots icon to open a menu.
Select Settings and click Site permissions.
Click Manage and delete cookies and site data to select your cookie preference from the provided options.
Account & Service Control · Procedure
Mozilla Firefox: how to set your cookie preference
For Mozilla Firefox, Hilton's instructions are: at the top right of the browser, click the three horizontal lines to open a menu, select Settings and click the Privacy & Security panel, then under Enhanced Tracking Protection select Custom, and finally click Cookies and select the cookie preference from the provided options.
Supporting quotations
Mozilla Firefox
At the top right of the Firefox browser, click the three horizontal lines to open a menu.
Select Settings and click the Privacy & Security panel.
Under Enhanced Tracking Protection, select Custom.
Click Cookies and select your cookie preference from the provided options.
Use & Processing · Company practice
Analytics providers, Adobe Analytics and Adobe Audience Manager
Hilton says it partners with certain third-party service providers to collect information for analytics, auditing, research and reporting, and that these third parties may use server logs, web beacons, tags, pixels and similar technologies and may set and access cookies on the visitor's computer or other device. In particular it uses Adobe Analytics to understand how customers use its websites, and Adobe Audience Manager to create audiences for personalising content and advertising experiences. The Statement then points to how Adobe uses personal information in web browsers by Adobe Analytics, which is a document this source does not contain.
Supporting quotations
Analytics and Interest-Based Advertisements
We partner with certain third-party service providers to collect information to engage in analytics, auditing, research, and reporting.
These third parties may use server logs, web beacons, tags, pixels, and similar technologies, and they may set and access cookies on your computer or other device.
In particular, we use Adobe Analytics to help us understand how our customers use our websites. We also use Adobe Audience Manager to create audiences for personalizing content and advertising experiences.
The third-party providers are described as partners Hilton has selected, not as a complete list of recipients.
The Statement's link to Adobe's privacy material is a link to another document whose text is not supplied here.
Not stated here
The linked Adobe privacy overview is not supplied in this source, so this card cannot say what Adobe's own privacy material requires or permits.
Use & Processing · Company practice
Amazon Chat, WhatsApp and LINE for personalised content, analytics and account linking
Hilton says it partners with Amazon Chat, which supports its chat platform, and may use it for sharing dynamic content for authenticated users. It uses WhatsApp and LINE to send personalised content and advertising experiences across multiple platforms, and may use them for analytics, research and reporting; it says it will use the visitor's WhatsApp and LINE phone number to link them to an existing Hilton account, if available, and to leverage their data to enhance its analytics across channels. If a Hilton Honors member follows Hilton on LINE and logs in via Universal Login, Hilton links the LINE identification number to the Hilton Honors account, and may then send personalised marketing messages on LINE if the member has consented to receiving marketing messages. The Statement links to WhatsApp's and LINE's own privacy material, which this source does not contain.
Supporting quotations
We partner with Amazon Chat which supports our chat platform. We may use Amazon Chat for sharing dynamic content for authenticated users.
We use WhatsApp and LINE to help us send you personalized content and advertising experiences across multiple platforms.
We will use your WhatsApp and LINE phone number to link you to your existing Hilton account (if available) and leverage your data to enhance our analytics, providing you with a richer customer experience across all channels.
If you are a Hilton Honors member, you follow Hilton on LINE, and you log in via Universal Login, we will link your LINE identification number to your Hilton Honors account.
If you have consented to receiving marketing messages from us, we may then send you personalized marketing messages on LINE.
Qualifications & exceptions
The account link through the WhatsApp or LINE phone number is stated to apply if an existing account is available.
LINE marketing messages are conditional on the member having consented to receiving marketing messages.
The linked WhatsApp and LINE privacy documents are not supplied in this source, so this card cannot say what they require.
Not stated here
The linked WhatsApp privacy policy and LINE privacy terms are not supplied in this source, so this card cannot say what those documents require of the platforms or of Hilton.
Sharing & Disclosure · Company practice
Interest-based advertising: third parties combine activity across sites, apps and devices
Hilton says it partners with third parties to provide advertising services targeted at a person's online activities across websites, mobile apps and devices over time, commonly called interest-based advertising. Its advertising partners may collect information about the person's activities on Hilton's services on their current device and combine it with information about their activities on other websites, mobile apps and devices, using server logs, cookies, web beacons, tags, pixels, mobile advertising identifiers such as Facebook cookies or Google's Advertising ID, cross-device linking and similar technologies. Advertising partners may use a site visit to target advertising on other websites and mobile apps, and may match browsers or devices if the person logs into the same online service on multiple devices or if the devices share attributes supporting an inference that they are used by the same person or household. The Statement adds that the person can opt out of interest-based advertising in web browsers and mobile apps on the current browser or device by following the instructions below.
Supporting quotations
We partner with third parties to provide advertising services that are targeted based on your online activities across websites, mobile apps, and devices over time (commonly referred to as “interest-based advertising”).
Our advertising partners may collect information about your activities on our Services on your current device and combine it with information about your activities on other websites, mobile apps, and devices.
They may collect such information using server logs, cookies, web beacons, tags, pixels, mobile advertising IDs (such as Facebook cookies or Google’s Advertising ID), cross-device linking, and similar technologies.
They may match your browsers or devices if you log into the same online service on multiple devices or if your devices share similar attributes that support an inference that they are used by the same person or household.
You can opt out of interest-based advertising in web browsers and mobile apps on your current browser or device by following the instructions below.
Qualifications & exceptions
The cross-device combination is described as something advertising partners may do, and the person-matching is described as an inference from logins or device attributes.
The opt-out described here is limited to the browser or device on which it is made.
Account & Service Control · User right or choice
Opting out of interest-based advertising: DAA principles, web browser and mobile app routes
Hilton points to the Network Advertising Initiative and Digital Advertising Alliance websites for more information on interest-based advertising and cross-device linking, and says it adheres to the DAA's interest-based advertising principles by providing enhanced notice, transparency and control of its digital marketing practices. To opt out in web browsers, it directs the visitor to the optout.aboutads.info and optout.networkadvertising.org pages, and notes that installing the DAA's 'Protect My Choices' extension helps preserve the choices made on the DAA's WebChoices page. To opt out in mobile apps, it describes adjusting advertising preferences on the mobile device — in iOS, Settings > Privacy & Security > Tracking, and in Android, Settings > Google > Ads > Opt out of interest-based ads — and using the DAA's AppChoices tool.
Supporting quotations
For more information about interest-based advertising and cross-device linking, please visit the
We adhere to the DAA’s interest-based advertising principles by providing you enhanced notice, transparency, and control of our digital marketing practices
You may opt out of interest-based advertising and cross-device linking in web browsers and mobile apps on your current browser or device by following the instructions below.
Web Browser Opt-Out. To opt out in web browsers, please visit
To help preserve the choices that you make in the DAA’s WebChoices page, you can install the DAA’s “Protect My Choices” extension
Mobile Application Opt-Out. To opt out in mobile apps, you can adjust the advertising preferences on your mobile device
You can also opt out for companies that participate in the Digital Advertising Alliance’s AppChoices tool
Qualifications & exceptions
The opt-out routes act on the browser or device on which they are exercised.
The 'Protect My Choices' extension is described as helping preserve choices already made on the DAA's WebChoices page.
Account & Service Control · User right or choice
Opt-outs are device-specific, do not track signals are not honoured, and global opt-out signals are
Hilton notes that the opt-outs it describes apply only to the specific browser or device from which the person opts out, so a person must opt out separately on every browser and device, and that if cookies or mobile advertising identifiers are deleted or reset, the browser is changed or upgraded, or a different device is used, an opt-out cookie or tool may no longer work and the person must opt out again. It states that it does not respond to Do Not Track signals at this time, and that it honours legally recognised global opt-out signals and provides a unified portal for all opt-out requests regardless of device or browser.
Supporting quotations
Please note that the opt-outs described above will apply only to the specific browser or device from which you opt out, and therefore you will need to opt out separately on all of your browsers and devices.
If you delete or reset your cookies or mobile advertising identifiers, change browsers (including upgrading certain browsers), or use a different device, any opt-out cookie or tool may no longer work, and you will need to opt out again.
We do not respond to Do Not Track signals at this time.
Global Opt-Out Signal. We honor legally-recognized global opt-out signals and provide a unified portal for all opt-out requests, regardless of device or browser.
Qualifications & exceptions
The opt-out is device- and browser-specific and can be lost when identifiers are reset or the browser or device changes.
Do Not Track signals are not responded to 'at this time'.
Global opt-out signals are honoured, with a unified portal for all opt-out requests.
Legal Rights & Agreement Rules · User right or choice
Your Rights and Choices: reviewing and updating the information you gave at enrollment
Hilton states that a Hilton Honors member may review and update the information provided at the time of enrollment at any time by signing in to the Hilton Honors account, and may also make changes by contacting Hilton Reservations and Customer Care at +1 888-4HONORS (888-446-6677) for the US and Canada; customers located outside the US and Canada can review global phone numbers, and a support form may also be completed. The right is stated for members, and the routes are Hilton's own channels rather than a regulator's process.
Supporting quotations
4. Your Rights and Choices
you may review and update the information you provided to us at the time of enrollment at any time
contacting Hilton Reservations and Customer Care at +1 888-4HONORS (888-446-6677) (US and Canada)
Customers located outside of the US and Canada can review our
You may also
Qualifications & exceptions
The review-and-update right is stated for Hilton Honors members.
The published telephone route is given for the US and Canada; other locations are directed to global phone numbers.
Legal Rights & Agreement Rules · User right or choice
Your Rights and Choices: the rights depend on where you live
Hilton states that depending on where you live, you may be able to request that it: informs you about the personal information it maintains about you; withdraws your consent for certain data processing activity; and/or updates, corrects, deletes and/or stops processing your personal information. The right to request is therefore stated as dependent on residence, and the statement describes the categories of request rather than a single universal entitlement.
Supporting quotations
Depending on where you live, you may be able to request that we:
inform you about the personal information we maintain about you,
withdraw your consent for certain data processing activity, and/or
update, correct, delete, and/or stop processing your personal information.
Qualifications & exceptions
Each of the three rights is qualified by 'depending on where you live'.
The right to withdraw consent is limited to processing that relies on consent.
Legal Rights & Agreement Rules · Procedure
Your Rights and Choices: how to submit a request, timing and fees
Hilton says that to see the rights based on residency or to submit a request, a person can visit the Data Subject Rights Requests Portal, email the Data Protection Office, or send a letter to the Hilton Data Protection Office in McLean, Virginia. It says it will process a request within the time specified by applicable law and as required by law, and that where the law permits, Hilton may charge an appropriate fee to cover the costs of responding. The rights available are shown by residency at the portal, and the timing is set by the applicable law rather than by a fixed period in this Statement.
Supporting quotations
To see your rights based on residency or submit a request:
visit the Data Subject Rights Requests Portal at
email DataProtectionOffice@hilton.com
send a letter to Hilton Data Protection Office, 7930 Jones Branch Drive, McLean, VA 22102, USA
We will process your request within the time specified by applicable law and as required by law.
When permitted by law, we may charge an appropriate fee to cover the costs of responding to the request.
Qualifications & exceptions
The processing time is the time specified by applicable law, and the fee is charged only where the law permits.
The portal shows the rights available based on the requester's residency.
Legal Rights & Agreement Rules · User right or choice
Your Rights and Choices: asking Hilton to stop sharing with business partners or to stop using your information
Hilton states that in some circumstances a person may request that it cease sharing their personal information with its business partners, or that Hilton cease using their personal information, by contacting Hilton using the email or mailing address given for rights requests. The right is qualified twice: it applies only 'in some circumstances', and it is exercised through the same contact routes as other rights requests.
Supporting quotations
In addition, in some circumstances you may request that we cease sharing personal information about you with our business partners or that Hilton cease using personal information about you by contacting us using the email or mailing address above.
Qualifications & exceptions
The right is available only 'in some circumstances'.
The request is made by the same email or mailing address used for other rights requests.
Legal Rights & Agreement Rules · User right or choice
Opting out of the sale of personal information or its sharing for targeted advertising
Hilton states that a person in an eligible location who wants to opt out of the sale of their personal information, or of sharing or processing it for targeted ads, may submit a request by clicking the 'Your Privacy Choices | Cookie Information' link at the bottom of the Hilton.com website when accessing it from an IP address indicating presence in a state that has enacted a privacy law. Opting out of cookies, tags and pixels applies only to the device and browser used at the time, so the person must opt out again on each other device or browser. Hilton honours legally recognized global opt-out signals and provides a unified portal for all opt-out requests regardless of device or browser, and residents of those states may request that Hilton no longer sell non-cookie based personal information or process it for targeted ads by making a Hilton Opt-out request.
Supporting quotations
If you are in an eligible location and would like to opt out of the sale of your personal information or sharing/processing it for targeted ads, you may submit a request by clicking the “ Your Privacy Choices | Cookie Information” link at the bottom of the Hilton.com website
when you opt out of cookies, tags, and pixels, that opt out only pertains to the device and the browser that you are using when you opt out.
We honor legally recognized global opt-out signals and provide a unified portal for all opt-out requests, regardless of device or browser.
residents in those states may request that we no longer sell non-cookie based personal information or process it for targeted ads
Qualifications & exceptions
The route depends on the visitor's IP address indicating presence in a state that has enacted a privacy law.
A cookie, tag and pixel opt-out is device- and browser-specific and must be repeated on each device.
Global opt-out signals are honoured and handled through a unified portal.
The non-cookie opt-out is a separate request from the cookie opt-out.
Legal Rights & Agreement Rules · User right or choice
Submitting a rights request on behalf of someone else
Hilton states that in some circumstances a person may have the option to submit a request on behalf of someone else as their legal representative, and that if they do so, they may be asked to provide proof of authorization. The requester's own authority therefore has to be evidenced before the request is acted on.
Supporting quotations
In some circumstances you may have the option to submit a request on behalf of someone else as their legal representative.
If you submit a request on behalf of someone else, then you may be asked to provide proof of authorization.
Qualifications & exceptions
The option applies only 'in some circumstances'.
Proof of authorization may be requested.
Use & Processing · Company practice
Marketing communications: channels, service providers and consent
Hilton says it may send communications by email, text message, push notifications, in-app alerts, direct mail and social media to tell the recipient about the products it offers, and that to enable this, the recipient's information may be disclosed to service providers who use it solely to send out marketing communications on Hilton's behalf. If, depending on the circumstances, consent is required in the recipient's jurisdiction, Hilton says it will obtain consent before sending such communications.
Supporting quotations
5. Marketing Communications Choices
we may send you communications via email, text message, push notifications, in-app alerts, direct mail, and social media
your information may be disclosed to service providers who use such information solely to send out marketing communications on our behalf
If, depending on the circumstances, consent is required in your jurisdiction, we will obtain your consent before sending you such communications.
Qualifications & exceptions
The consent requirement is conditional on the circumstances and on the jurisdiction.
Service providers are limited to using the information to send marketing communications on Hilton's behalf.
Use & Processing · Company practice
In-stay SMS and WhatsApp messaging service, and how to stop it
Hilton says an SMS messaging service is among the services provided during a stay. If the guest gave Hilton a mobile telephone number, the property where they are staying may contact them by SMS or WhatsApp to welcome them on arrival, to let them submit questions or request additional services, to notify them of problems with the room, and mid-stay to remind them the service is available. The guest can reply to those messages with questions or requests, and can opt out of receiving the SMS or WhatsApp messages by replying 'STOP' to any message.
Supporting quotations
Included in the services that Hilton provides during your stay is an SMS messaging service.
the property where you are staying may contact you by SMS or WhatsApp to welcome you upon your arrival and permit you to submit questions or request additional services via SMS or WhatsApp.
You can opt out of receiving these SMS or WhatsApp messages by replying “STOP” to any message.
Qualifications & exceptions
Contact depends on the guest having given Hilton a mobile telephone number.
The property, not Hilton centrally, may send these messages.
Opting out is by replying 'STOP' to any message.
Account & Service Control · Company practice
Short codes for transactional and promotional messages on WhatsApp and SMS
Hilton offers the opportunity to receive transactional and promotional messages via WhatsApp or text message by messaging a five-digit short code to opt in: 97176 for transactional messages and 75712 for promotional messages. Message frequency varies, message and data rates may apply, and help is available by replying 'HELP'. Hilton states that short code opt-in data and consent will not be shared with any other third parties for their own marketing or advertising purposes.
Supporting quotations
A short code is a five-digit number that you can message to opt-in to receive such text messages.
The code for transactional messages is 97176. The code for promotional messages is 75712.
Message frequency varies. Message and data rates may apply.
Short code opt-in data and consent will not be shared with any other third parties for their own marketing or advertising purposes.
Qualifications & exceptions
The short codes are opt-in, and the transactional and promotional codes are different.
Message and data rates may apply, and frequency varies.
The no-sharing statement is limited to sharing opt-in data and consent for third parties' own marketing or advertising.
Account & Service Control · User right or choice
Hilton Honors members: change the communications received through the online account
Hilton states that a Hilton Honors member may change the communications they receive by logging on to their online account and managing their subscriptions. The route is the member's own account settings rather than a request to the Data Protection Office.
Supporting quotations
If you are a Hilton Honors member, you may change the communications you receive from us by logging on to your online account and managing your subscriptions.
Qualifications & exceptions
The stated route applies to Hilton Honors members.
Account & Service Control · User right or choice
Opting out of email marketing materials
Hilton states that a recipient who prefers not to receive email marketing materials may opt out at any time, and gives the unsubscribe method: using the unsubscribe function in any email received from Hilton, or clicking the unsubscribe link. The other channels for marketing opt-out requests — email, mail, SMS or WhatsApp reply, and hotel-specific texts — are listed in the next part of the section.
Supporting quotations
Marketing Opt-Out Requests
If you prefer not to receive email marketing materials from us, you may opt-out at any time by using the following methods:
Unsubscribe: Use the unsubscribe function in any email you receive from us or by clicking this link:
Qualifications & exceptions
The email opt-out may be exercised at any time.
Only the email route is described in this part; the section continues with other channels.
Account & Service Control · User right or choice
Marketing opt-out requests: email, mail, SMS or WhatsApp reply, and hotel-specific texts
Hilton lists the routes for marketing opt-out requests: by email to the Data Protection Office; by mail to Hilton's Data Protection Office in McLean, Virginia; by SMS short code, text or WhatsApp message, by replying 'STOP' to the message received; and, for hotel-specific texts, by contacting the hotel front desk to say the guest does not want to receive text messages. The hotel-specific route is handled by the property rather than by Hilton's central office.
Supporting quotations
Email: DataProtectionOffice@hilton.com
Mail: Write to Hilton’s Data Protection Office, 7930 Jones Branch Drive, McLean, VA 22102, USA
SMS Short Code, Text, or WhatsApp messages: Reply “STOP” to the message you received
Hotel-specific texts: Contact the hotel front desk to inform them that you do not want to receive text messages
Qualifications & exceptions
Hotel-specific text messages are stopped by contacting that hotel's front desk, not the Data Protection Office.
The SMS, text and WhatsApp route is a reply of 'STOP' to the message received.
Account & Service Control · Company practice
Marketing opt-out requests can take up to ten business days to take effect
Hilton warns that opt-out requests can take up to ten business days to become effective, so a request to stop marketing communications is not stated to take effect immediately.
Supporting quotations
Please note that opt-out requests can take up to ten business days to be effective.
Qualifications & exceptions
The stated period is up to ten business days.
Account & Service Control · User right or choice
Push and in-app notification controls on the device and in the app
Hilton says a person may control whether its mobile apps send push notifications by changing the notification settings on their mobile device, and that if it sends in-app messages, it will allow control for those in its apps' settings. The control is therefore in the operating system for push notifications and in the Hilton app for in-app messages.
Supporting quotations
You may control whether our mobile apps send you push notifications by changing your notification settings on your mobile device.
If we engage in sending you in-app messages, we will allow control for those in our apps’ settings.
Qualifications & exceptions
Push notification control sits in the device's notification settings; in-app message control sits in the app's own settings.
The in-app control is stated as something Hilton 'will allow'.
Security & Safeguards · Company commitment
How Hilton protects personal information: reasonable measures and a dedicated security team
Hilton says it takes reasonable measures to protect personal information from unauthorized access, disclosure, alteration or destruction, and to keep it accurate and up to date as appropriate. It employs a dedicated global information security team responsible for managing the security programme, which monitors systems for potential intrusions, responds to potential incidents, supports property-level information security, regularly reviews and updates the security controls used to protect data, and provides training on the programme. The measures are described as reasonable measures and the team as a robust team; the statement gives no certification level or incident record.
Supporting quotations
6. How We Protect Personal Information
We take reasonable measures to: (i) protect personal information from unauthorized access, disclosure, alteration, or destruction, and (ii) keep personal information accurate and up-to-date as appropriate.
Hilton employs a robust team of dedicated information security professionals who are responsible for managing Hilton’s security program.
This team is responsible for, among other things, monitoring our systems for potential intrusions, responding to potential incidents, supporting property-level information security, regularly reviewing and updating the security controls Hilton uses to protect data, and providing training on Hilton’s information security program.
Qualifications & exceptions
The commitment is to 'reasonable measures' and to accuracy 'as appropriate', not to an absolute guarantee.
The security programme description lists activities; it does not state how effective they are.
Security & Safeguards · Company commitment
Security controls, third-party confidentiality, no card details by message, and incident notification
Hilton says it implements risk-based security controls, including encryption and ongoing employee training, aligned with industry standards, and maintains a payment card industry (PCI) compliance programme and an information technology compliance programme. That programme generates audit reports on the adequacy and effectiveness of Hilton's technology internal controls, including a PCI Attestation of Compliance signed by an external PCI Qualified Security Assessor and an SSAE16/SOC1 report on technology general controls supporting certain accounting and financial reporting. Hilton requires third parties it shares personal information with to exercise reasonable efforts to maintain confidentiality, says it will never ask a person to send confidential personal information or payment card information by email or text message, and says that in the event of a security incident it will notify regulators and/or affected individuals in a timely manner as required by applicable laws and regulations.
Supporting quotations
Hilton implements risk-based security controls, including encryption and ongoing employee training, aligned with industry standards.
Hilton maintains a payment card industry (“PCI”) compliance program and an Information Technology compliance program.
This compliance program generates audit reports concerning the adequacy and effectiveness of Hilton’s Technology internal controls, including a PCI Attestation of Compliance signed by an external PCI Qualified Security Assessor and a SSAE16/SOC1 report addressing the Technology general controls over systems that support certain accounting and financial reporting.
We require third parties with whom we share personal information to exercise reasonable efforts to maintain the confidentiality of personal information.
We will never ask you to send us confidential personal information or payment card information via email or text message.
In the event of a security incident, Hilton will notify regulators and/or affected individuals in a timely manner as required by applicable laws and regulations.
Qualifications & exceptions
The controls are described as risk-based and aligned with industry standards.
The obligation imposed on third parties is to exercise reasonable efforts, not a stated guarantee of confidentiality.
Incident notification is tied to what applicable laws and regulations require, and 'timely' is not defined here.
Sharing & Disclosure · Context
How We Disclose Personal Information: what this section adds to the collection section
Hilton introduces its disclosure section by saying that, in addition to the information given in the Personal Information We Collect section, the following summarises how it may disclose personal information. The section therefore adds a summary of disclosure to the earlier collection disclosures rather than replacing them.
Supporting quotations
7. How We Disclose Personal Information
In addition to the information provided in the Personal Information We Collect section, the following summarizes how we may disclose personal information.
Qualifications & exceptions
The disclosure summary is additional to the collection section, not a restatement of it.
Sharing & Disclosure · Company practice
Disclosure to protect safety and security, and disclosure required by law
Hilton says it will disclose personal information as required by law, giving as examples the case where countries require it to collect personal data about visitors to properties in that country, where a law enforcement agency serves a valid subpoena, and where a civil litigant serves a lawful discovery request. It also says it may elect to share personal information with law enforcement, employers, those who host events with Hilton or others as necessary to protect the safety and security of people and property, to pursue available remedies or limit the damages it may sustain, and to respond to an emergency. The disclosure to law enforcement and employers is therefore stated as something Hilton may elect to do, not only something it must do.
Supporting quotations
Protection of Safety and Security
Hilton will disclose personal information as required by law.
Examples of such disclosures include when countries require Hilton to collect personal data about visitors to properties in that country, when a law enforcement agency serves a valid subpoena on Hilton, and when a civil litigant serves a lawful discovery request on Hilton.
Hilton may elect to share personal information with law enforcement, employers, those who host events with Hilton, or others as necessary to protect the safety and security of people and property, to pursue available remedies or limit the damages that we may sustain, and to respond to an emergency.
Qualifications & exceptions
The mandatory disclosures are qualified by 'required by law' and by the validity of the subpoena or discovery request.
The safety and security disclosures are framed as a Hilton election ('may elect to share') for the purposes listed, including limiting Hilton's own damages.
Sharing & Disclosure · Company practice
e-Folio Program: a folio extract may go to the employer and the credit card company
Hilton says that if a person is an employee of a company participating in the Hilton e-Folio Program, and books a room using a company corporate code or pays expenses with a corporate credit card, Hilton may send the employer and the credit card company an extract of the folio detailing the goods and services provided. The disclosure is to two recipients and is limited to an extract of the folio.
Supporting quotations
E-Folio Program
If you are an employee of a company that participates in the Hilton e-Folio Program and you book your room using a company corporate code or pay for your expenses using a corporate credit card, we may send your employer and the credit card company an extract of your folio detailing the goods and services provided to you.
Qualifications & exceptions
The disclosure applies only to employees of companies in the e-Folio Program who book with a corporate code or corporate credit card.
What is sent is an extract of the folio, not the whole folio.
Sharing & Disclosure · Company practice
Reservations with partner accommodations: AutoCamp, SLH and Evermore Resort receive guest information
Hilton says that when a guest makes a reservation with AutoCamp, Small Luxury Hotels of the World (SLH) or Evermore Resort – Orlando through a Hilton channel, it will provide certain guest information for the exclusive purpose of fulfilling the reservation and providing customer support, as identified in the collection section of this Statement. The Hilton channels named are its website, the Hilton Honors application and Mini Programs, and the guest information will be processed and retained in accordance with the partner's own privacy policies and as permitted by applicable law. The Statement then points to each partner's privacy policy, documents that are not supplied in this source.
Supporting quotations
Reservations with Hilton Partner Accommodations
Hilton will provide certain guest information for the exclusive purpose of fulfilling the reservation and providing customer support
The guest information will be processed and retained in accordance with their privacy policies and as permitted by applicable law.
AutoCamp: You can access AutoCamp’s privacy policy
SLH: You can access SLH’s privacy policy
Evermore Resort – Orlando: You can access Evermore Resort’s privacy policy
Qualifications & exceptions
The purpose is stated as the exclusive one of fulfilling the reservation and providing customer support.
The partner processes and retains the data under its own privacy policies, which this source does not reproduce.
Not stated here
The linked AutoCamp privacy policy is not supplied in this source, so this card cannot say what it requires.
The linked SLH privacy policy is not supplied in this source, so this card cannot say what it requires.
The linked Evermore Resort privacy policy is not supplied in this source, so this card cannot say what it requires.
Sharing & Disclosure · Company practice
Reservations with Hilton's third-party partners: HGV and Placemakr receive booking information
Hilton says that when a guest makes a reservation with Hilton Grand Vacations (HGV) through a Hilton channel, it provides the information given for the booking to HGV to fulfil the reservation; the channels named are its website, the Hilton Honors application and the Hilton Honors Mini Programs. HGV may also process the personal information in accordance with HGV's privacy policies and as permitted by applicable law, and Hilton may also share personal data with HGV if the guest is a Hilton Honors member; depending on the jurisdiction, prior consent to share may be required, and in that case Hilton says it will obtain consent during the Hilton Honors enrolment journey. The same structure applies to Placemakr, whose data may also be processed under its own privacy policies and with prior consent where required. The Statement points to each partner's privacy policy, documents that are not supplied in this source.
Supporting quotations
Reservations with Hilton’s Third-Party Partners
Hilton Grand Vacations: When making a reservation with Hilton Grand Vacations (HGV) through a Hilton channel, Hilton will provide the information you provided for your booking to HGV to fulfill your reservation.
HGV may also process your personal information in accordance with HGV’s privacy policies and as permitted by applicable law.
Depending on your jurisdiction, prior consent to share your personal data with HGV may be required. If this is the case, we will obtain your consent to do so during the Hilton Honors enrollment journey.
Placemakr: When making a reservation with Placemakr through Hilton channel, Hilton will provide the information you provided for your booking to Placemakr to fulfill your reservation.
Depending on your jurisdiction, prior consent to share your personal data with Placemakr may be required. If this is the case, we will obtain your consent.
Qualifications & exceptions
Sharing with HGV for a Hilton Honors member is a separate ground from the booking itself.
Prior consent to share may be required depending on the jurisdiction, and is then obtained during enrolment.
The partners' own privacy policies govern their processing and are not reproduced here.
Not stated here
The linked Hilton Grand Vacations privacy notice is not supplied in this source, so this card cannot say what it requires.
The linked Placemakr privacy policy is not supplied in this source, so this card cannot say what it requires.
Sharing & Disclosure · Company practice
Reservations with Hilton's third-party operator: Genting receives booking information from US guests
Hilton says that if a guest who lives in the United States makes a reservation at Resorts World Las Vegas, Conrad Las Vegas or Crockfords Las Vegas through a Hilton channel, it will provide its Third-Party Operator, Genting, with the information provided for the booking to fulfil the reservation; the channels named are its website, the Hilton Honors application and Mini Programs. Genting may also process the personal information in accordance with Genting's privacy policies and as permitted by applicable law. The Statement points to Genting's privacy policy, a document that is not supplied in this source.
Supporting quotations
Reservations with Hilton’s Third-Party Operator
If you are a guest who lives in the United States, when you make a reservation with Resorts World Las Vegas, Conrad Las Vegas, or Crockfords Las Vegas through a Hilton channel, we will provide our Third-Party Operator, Genting with the information you provided for your booking to fulfill your reservation.
Genting may also process your personal information in accordance with Genting’s privacy policies and as permitted by applicable law.
Qualifications & exceptions
The disclosure is stated for guests who live in the United States.
Genting's own processing is governed by its privacy policies, which are not reproduced here.
Not stated here
The linked Genting privacy policy is not supplied in this source, so this card cannot say what it requires.
Sharing & Disclosure · Company practice
Reservations with Hilton Principal: BRE Hotels & Resorts receives booking information from US guests
Hilton says that if a guest who lives in the United States makes a reservation at the Waldorf Astoria Grand Wailea, it will provide BRE Hotels & Resorts, the hotel's owner, described as 'Hilton Principal', with the booking information. BRE may process the personal information in accordance with its privacy policy and as permitted by applicable law. The Statement points to BRE's privacy policy, a document that is not supplied in this source.
Supporting quotations
Reservations with Hilton Principal
If you are a guest who lives in the United States, when you make a reservation at the Waldorf Astoria Grand Wailea, Hilton will provide BRE Hotels & Resorts (or “Hilton Principal”), the hotel’s owner, with your booking information.
BRE may process your personal information in accordance with its privacy policy and as permitted by applicable law.
Qualifications & exceptions
The disclosure is stated for guests who live in the United States.
BRE's own processing is governed by its privacy policy, which is not reproduced here.
Not stated here
The linked BRE Hotels & Resorts privacy policy is not supplied in this source, so this card cannot say what it requires.
Sharing & Disclosure · Company practice
Reservations with Select by Hilton: YOTEL receives booking information
Hilton says that when a guest makes a reservation with YOTEL through a Hilton channel, it will provide YOTEL with the booking information, and that YOTEL may process the personal information in accordance with its privacy policy and as permitted by applicable law. The Statement points to YOTEL's privacy policy, a document that is not supplied in this source.
Supporting quotations
Reservations with Select by Hilton
YOTEL: When you make a reservation with YOTEL through a Hilton channel, Hilton will provide YOTEL with your booking information.
YOTEL may process your personal information in accordance with its privacy policy and as permitted by applicable law.
Qualifications & exceptions
YOTEL's own processing is governed by its privacy policy, which is not reproduced here.
Not stated here
The linked YOTEL privacy policy is not supplied in this source, so this card cannot say what it requires.
Sharing & Disclosure · Company practice
International transfers: sharing across the Portfolio, and transfer of reservation data to the United States
Hilton describes itself as a global company that seeks to provide the same level of service whether the guest is in San Francisco, London or Tokyo, and says the guest acknowledges that personal information may be shared among members of the Hilton Portfolio of Brands, its service providers and other third parties, which may be located in countries outside the guest's own. It says that when a guest stays at a Hilton property outside the United States, the data controller for that property transfers the personal information relating to the reservation to Hilton in the United States pursuant to data transfer agreements where applicable laws or regulations require them; that controller may also keep a local copy of the personal information, which in some cases the applicable law requires; and that although data protection laws differ between countries, Hilton will take appropriate steps to ensure the information is handled as described in this Statement and in accordance with the law.
Supporting quotations
8. International Transfers
As a global company, we endeavor to provide you with the same level of service that you have come to expect at Hilton whether you are in San Francisco, London or Tokyo.
you acknowledge that we may share your personal information among members of the Hilton Portfolio of Brands, our service providers, and other third parties, which may be located in countries outside of your own.
When you stay at a Hilton property outside the United States, the data controller for that property transfers the personal information relating to your reservation to Hilton in the United States pursuant to data transfer agreements when required by applicable laws or regulations.
The data controller may also maintain a local copy of your personal information, and in some cases this is required by applicable laws or regulations.
we will take appropriate steps to ensure that your personal information is handled as described in this Statement and in accordance with the law.
Qualifications & exceptions
Recipients may be located outside the guest's own country, and the sharing is acknowledged rather than presented as a unilateral choice.
The transfer to the United States is stated to be pursuant to data transfer agreements only where applicable law or regulation requires them.
A local copy of the personal information may be kept by the property's controller, in some cases because the law requires it.
The safeguard is stated as 'appropriate steps' to handle the information as described and in accordance with the law.
Retention & Deletion · Company practice
Data retention periods: kept as long as the purpose requires, then destroyed beyond reconstruction
Hilton says it retains personal information for the time necessary to fulfil the purpose for which it was collected, usually for the duration of any contractual relationship and for any period afterwards as legally required or permitted by law. It says its retention policies reflect applicable limitation periods and legal requirements, and that when it destroys personal information, it does so in a way that prevents the information from being restored or reconstructed. The statement sets a purpose-based retention rule rather than a list of fixed periods; the specific periods for individual categories are not given in this section.
Supporting quotations
9. Data Retention Periods
We retain personal information about you for the time necessary to fulfill the purpose for which that information was collected, usually for the duration of any contractual relationship and for any period thereafter as legally required or permitted by law.
Our retention policies reflect applicable statute of limitation periods and legal requirements.
When we destroy your personal information, we do so in a way that prevents that information from being restored or reconstructed.
Qualifications & exceptions
Retention is tied to the collection purpose, the contractual relationship, and any period required or permitted by law, rather than to fixed dates in this Statement.
Destruction is described as preventing restoration or reconstruction, not as a stated deletion method.
This section does not give per-category retention periods.
Legal Rights & Agreement Rules · Context
Contact information for questions or concerns: the Data Protection Office
Hilton directs any questions or concerns to its Data Protection Office, giving the contact routes: email DataProtectionOffice@hilton.com; postal address Hilton Data Protection Office, 7930 Jones Branch Drive, McLean, VA 22102; telephone (800) 413-7470; and the Data Subject Rights Requests Portal at datarights.hilton.com. The stated contact point is a United States address and a United States toll-free number.
Supporting quotations
10. Contact Information for Questions or Concerns
If you have any questions or concerns, please contact Hilton’s Data Protection Office.
Email: DataProtectionOffice@hilton.com
Address: Attn: Hilton Data Protection Office, 7930 Jones Branch Drive, McLean, VA 22102
The contact point is a United States address and a United States toll-free number, although the Statement applies globally.
The portal is stated as the route for data subject rights requests.
Legal Rights & Agreement Rules · Company practice
Changes to this Statement: changes take effect on posting, and continued use means acceptance
Hilton says it may modify the Statement from time to time, and that the date at the top of the Statement shows when it was last updated. It says any changes become effective upon posting of the revised Statement on the site, and that using the site, any of its products and services, consenting to and/or having the opportunity to review the updated Statement after a change constitutes acceptance of the revised Statement then in effect.
Supporting quotations
11. Changes to this Statement
We may modify this Statement from time to time.
Any changes to our Statement will become effective upon posting of the revised Statement on the site.
Use of the site, any of our products and services, consenting to and/or having the opportunity to review the updated Statement following such changes constitutes your acceptance of the revised Statement then in effect.
Qualifications & exceptions
Changes take effect by posting, without a separate notice period stated here.
Acceptance is stated to follow from use, from consenting, or even from having had the opportunity to review the updated Statement.
Legal Rights & Agreement Rules · Context
Summary of material changes: August 2026
The Statement carries a summary of material changes, with the last update shown as August 2026. The August 2026 entries are: the Marketing Communications Choices section was updated to include additional details on SMS messaging and short code, and Appendix A-6 China Residents was updated to include updated information on collection and entrusted processing of personal information.
Supporting quotations
Summary of Material Changes to this Statement
Last update: August 2026
August 2026 Updates
Updated the Marketing Communications Choices section to include additional details on SMS messaging and short code.
Updated Appendix A-6: China Residents to include updated information on collection and entrusted processing of personal information.
Qualifications & exceptions
The summary covers the changes Hilton calls material; the Statement does not define the test.
The August 2026 entries concern SMS and short-code detail and the China appendix.
Legal Rights & Agreement Rules · Context
Summary of material changes: May and April 2026
The May 2026 entry records that the Appendix A-11 Mexico Residents and A-12 Albania Residents sections were added. The April 2026 entries record that the Introduction was updated to reflect two further Portfolio of Brands, Apartment Collection by Hilton and Select by Hilton; that the Reservations with Hilton's Third-Party Partner section was updated to include Placemakr; that the How We Disclose Personal Information section was updated to include information on the e-Folio Program and Reservations with Select by Hilton; that Appendix A-10 was updated to align with the Personal Information Protection Act; and that the Changes to this Statement section was updated to include a summary of material changes.
Supporting quotations
May 2026 Updates
Added the Appendix A-11: Mexico Residents and A-12: Albania Residents sections.
April 2026 Updates
Updated the Introduction section to reflect additional Hilton Portfolio of Brands: Apartment Collection by Hilton and Select by Hilton.
Updated the Reservations with Hilton’s Third-Party Partner section to include Placemakr.
Updated the How We Disclose Personal Information section to include information on the e-Folio Program and Reservations with Select by Hilton.
Updated Appendix A-10 to align with the Personal Information Protection Act.
Updated the Changes to this Statement section to include a summary of material changes.
Qualifications & exceptions
The summary lists changes Hilton identifies as material; it is not a complete list of edits.
Legal Rights & Agreement Rules · Context
Appendix A: additional provisions for residents of certain countries and US states, which override the main body on
Appendix A provides additional information for individuals residing in countries and US states that have enacted privacy laws giving residents of those jurisdictions additional rights. The US states listed include Alabama, California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Louisiana, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Nevada, Oklahoma, Oregon, Rhode Island, Tennessee, Texas, Utah, Vermont and Virginia, and the countries include the EEA, the United Kingdom, Switzerland, Australia, Bermuda, Brazil, Canada, China, Korea, Hong Kong, Monaco, Israel, Japan, Nigeria and Türkiye. The Appendix outlines the additional information Hilton must give and the rights the person has under applicable local laws, and it states that it controls to the extent it conflicts with any provision in the main body of the Statement.
Supporting quotations
Appendix A: Additional Provisions Applicable to Residents of Certain Countries and US States
This Appendix provides additional information for individuals residing in countries and U.S. states that have enacted privacy laws giving certain additional rights to residents of those jurisdictions.
Once effective, the U.S. states include, but are not limited to, Alabama, California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Louisiana, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Nevada, Oklahoma, Oregon, Rhode Island, Tennessee, Texas, Utah, Vermont, and Virginia.
These countries include, but are not limited to, those in the European Economic Area (EEA), the United Kingdom and Switzerland, as well as Australia, Bermuda, Brazil, Canada, China, Korea, Hong Kong, Monaco, Israel, Japan, Nigeria, and Türkiye.
This Appendix will control to the extent it conflicts with any provision in the main body of this Statement.
Qualifications & exceptions
Both lists are given as examples: 'include, but are not limited to'.
The Appendix controls over the main body where they conflict, so the regional terms are the operative ones for those residents.
The rights described are the rights the person has under applicable local laws, not a single global standard.
Legal Rights & Agreement Rules · Context
Appendix A: how to reach the controller and the Data Protection Office
Within Appendix A, the controller entry says to refer to the Data Protection Office for the contact information of other entities that may receive the personal data, and the Data Protection Office entry gives the email address DataProtectionOffice@Hilton.com and the postal address Attn: Data Protection Office, 7930 Jones Branch Drive, McLean, VA 22102, USA.
Supporting quotations
Controller: Please refer to the Data Protection Office at
Data Protection Office: Hilton’s Data Protection Office may be contacted by email at DataProtectionOffice@Hilton.com
Attn: Data Protection Office 7930 Jones Branch Drive McLean, VA 22102 USA
Qualifications & exceptions
The controller entry points to the Data Protection Office for the identity of other recipients, rather than naming them here.
The stated address is in the United States.
Legal Rights & Agreement Rules · Company practice
Purposes and legal basis: the five stated bases, and the basis follows the purpose
Appendix A states that Hilton processes personal information for the purposes set out in the Personal Information We Collect section of the main body, and that the legal bases for its processing activities include processing necessary to comply with contractual obligations, compliance with legal obligations, protecting the safety of employees, guests and others, pursuing legitimate business interests, and processing pursuant to the person's consent. It adds that the particular legal basis for processing a piece of personal information is based on the purpose for which that information was provided or collected. This is the European-style basis-and-purpose structure in Appendix A, which controls over the main body for the residents it covers.
The legal bases for Hilton’s processing activities include processing such information as necessary to comply with our contractual obligations, compliance with our legal obligations, protecting the safety of our employees, guests and others, for our legitimate business interests, and pursuant to your consent.
The particular legal basis for the processing of your personal information is based on the purpose for which such information was provided or collected.
Qualifications & exceptions
The legal basis is stated to follow the purpose, so the basis for a given item depends on why it was collected.
This text sits in Appendix A, which applies to the residents of the listed jurisdictions and overrides the main body on conflict.
Legal Rights & Agreement Rules · Company practice
Legal basis for Hilton Honors participation: contract, consent where required, legitimate interests
For the personal information obtained in connection with participation in the Hilton Honors program, Hilton states that it processes the information on the basis of its contractual relationship with the person, consent if legally required, and for pursuing legitimate business interests, including personalising the person's use of its services and applications, communicating news and promotional items, and delivering personalised advertising and content.
Supporting quotations
Hilton Honors Participation: We process the personal information obtained in connection with your participation in the Hilton Honors program on the basis of our contractual relationship with you, consent if legally required, and for pursuing our legitimate business interests
including to personalize your use of our services and applications, to communicate news and promotional items, and to deliver personalized advertising and content
Qualifications & exceptions
Consent is one of three bases and applies only where legally required.
Personalisation and personalised advertising are stated as legitimate-interest purposes.
Legal Rights & Agreement Rules · Company practice
Legal basis for post-stay surveys: voluntary, consent plus business interests
Hilton says it may send post-stay surveys by SMS or email, that completion of the surveys is voluntary, and that it processes the information obtained from surveys on the basis of consent and in furtherance of its business interests, including marketing, service improvements and analytics.
Supporting quotations
Surveys: We may send post-stay surveys via SMS or email.
Completion of surveys is voluntary – we process the information obtained from surveys on the basis of your consent and in furtherance of our business interests, including marketing, service improvements, and analytics.
Qualifications & exceptions
Completion of the surveys is voluntary.
Marketing is a stated business interest for survey data.
Legal Rights & Agreement Rules · Company practice
Legal basis for on-property collection: contract, legitimate interests, and legal obligations at registration
Hilton says that when a guest makes a reservation and stays at one of its hotel properties, it processes the guest's name, address, contact information and the details of the stay — arrival and departure day and time, vehicle information and information about others travelling or staying with the guest — on the basis of its contractual relationship with the guest. It says it also processes that data for legitimate business interests, with consent where legally required, including marketing, service improvements, administration of the e-Folio programme, and analytics and service personalisation. It separately collects additional personal information at registration and check-in, such as national ID or passport information, as necessary to comply with its legal obligations.
Supporting quotations
On-Property Collection: When you make a reservation and when you stay at one of our hotel properties, we process your name, address, contact information, along with the details of your stay (arrival and departure day and time, vehicle information and information regarding others traveling or staying with you), on the basis of our contractual relationship with you.
We also process such data for pursuing our legitimate business interests, with your consent if legally required, including for marketing, service improvements, administration of our e-Folio program, and analytics and service personalization
We collect certain additional personal information during registration/check-in at our properties (such as national ID or passport information), as necessary to comply with our legal obligations.
Qualifications & exceptions
The stay details include information about other people travelling or staying with the guest.
Consent is required for the legitimate-interest processing only where legally required.
National ID or passport information at registration or check-in is collected to meet legal obligations, not for service delivery.
Legal Rights & Agreement Rules · Company practice
Legal basis for on-property CCTV and location monitoring: protection of staff, guests and visitors
Hilton states that it uses closed-circuit television and other security measures at its properties, which may capture or record images of guests and visitors in public areas, and information related to the guest's location while on its properties, via keycards and other technologies, for the protection of Hilton's staff, guests and visitors. The stated purpose is protection of people on the property; keycard and similar location tracking is named alongside CCTV.
Supporting quotations
We use closed circuit television and other security measures at our properties that may capture or record images of guests and visitors in public areas, as well as information related to your location while on our properties (via keycards and other technologies) for the protection of our staff, guests and visitors to our properties.
Qualifications & exceptions
CCTV is stated to capture images of guests and visitors in public areas.
Location information is collected through keycards and other technologies while the guest is on the property.
Legal Rights & Agreement Rules · Company practice
Legal basis for on-property services: concierge, spas, childcare, equipment rental and Digital Key
Hilton states that it processes personal information in connection with on-property services — concierge services, health clubs, spas, activities, child care services, equipment rental and the Digital Key functionality — in order to provide those services and for its business interests, including marketing, service improvements, administration of the e-Folio programme, and analytics and service personalisation.
Supporting quotations
We process personal information in connection with on-property services (such as concierge services, health clubs, spas, activities, child care services, equipment rental, and our Digital Key functionality), in order to provide the services to you and for our business interests including for marketing, service improvements, administration of our e-Folio program, and analytics and service personalization
Qualifications & exceptions
The stated purposes include the business-interest purposes, not only service delivery.
The categories named include child care services and the Digital Key functionality.
Legal Rights & Agreement Rules · Company practice
Legal basis for event profiles: contract plus legitimate interests, with consent where required
For event profiles, Hilton states that it processes the personal information obtained in connection with the person's event on the basis of its contractual relationship with the person and for pursuing legitimate business interests, with consent where legally required, including for marketing, service improvements, and analytics and service personalisation.
Supporting quotations
Event Profiles: We process the personal information obtained in connection with your event on the basis of our contractual relationship with you and for pursuing our legitimate business interests, with your consent if legally required, including for marketing, service improvements, and analytics and service personalization
Qualifications & exceptions
Consent is required for the legitimate-interest processing only where legally required.
Legal Rights & Agreement Rules · Company practice
Legal basis for social media participation: voluntary, consent where required plus legitimate interests
Hilton states that participation in Hilton-sponsored social media activities and offerings is voluntary, and that it processes information obtained from such participation on the basis of consent where legally required and for pursuing legitimate business interests, including for marketing, service improvements, and analytics and service personalisation.
Supporting quotations
Social Media: Participation in Hilton-sponsored social media activities and offerings is voluntary - we process information obtained from social media participation on the basis of your consent if legally required and for pursuing our legitimate business interests, including for marketing, service improvements, and analytics and service personalization
Qualifications & exceptions
Participation is voluntary.
Consent applies where legally required; the business-interest purposes are stated in addition.
Legal Rights & Agreement Rules · Company practice
Legal basis for promotions and sweepstakes: voluntary, consent and administration of the offering
Hilton states that participation in sweepstakes, contests and other promotional offerings is voluntary, and that it processes the information obtained from such participation based on consent and as necessary to administer the offering. It also says it uses certain data for its business purposes, including marketing, service improvements, administration of the e-Folio programme, and analytics and service personalisation.
Supporting quotations
Promotions and Sweepstakes: Participation in sweepstakes, contests and other promotional offerings is voluntary – we process the information obtained from such participation based on your consent and as necessary to administer the offering.
We also use certain data for our business purposes, including for marketing, service improvements, administration of our e-Folio program, and analytics and service personalization
Qualifications & exceptions
Participation is voluntary.
The business-purpose uses apply to certain data from the participation, on top of administering the offering.
Legal Rights & Agreement Rules · User right or choice
Direct marketing: sent on consent, withdrawable by email, unsubscribe or account preferences
Hilton states that it uses personal information to send marketing messages on the basis of consent, and that consent for direct marketing communications may be withdrawn at any time by contacting the Data Protection Office, by following the unsubscribe instructions in the marketing message received, or by logging in to the Hilton Honors account and updating communication preferences. The three routes for withdrawal are given side by side.
Supporting quotations
Direct Marketing: We use your personal information to send you marketing messages on the basis of your consent.
You may withdraw your consent for direct marketing communications at any time by contacting us at DataProtectionOffice@hilton.com
following the unsubscribe instructions in the marketing message you received, or by logging in to your Hilton Honors account and updating your communication preferences
Qualifications & exceptions
Marketing messages are stated to be sent on the basis of consent, and consent may be withdrawn at any time.
The account route applies to Hilton Honors members who can update their communication preferences.
Legal Rights & Agreement Rules · Company practice
Legal bases for franchise and ownership opportunities and for the supplier diversity programme
For franchise and ownership opportunities, Hilton states that it processes the information on the basis of its contractual relationship with the person and for its related legitimate business interests, including maintaining and promoting the Hilton brand and facilitating direct communication between properties within the Portfolio of Brands. For its Supplier Diversity Programme, it states that participation is voluntary and that it processes the information based on consent and for its related legitimate business interests, including maintaining and enhancing the diversity programme.
Supporting quotations
Franchise and Ownership Opportunities: We process this information on the basis of our contractual relationship with you and for our related legitimate business interests, including maintaining and promoting the Hilton brand and facilitating direct communication between properties within the Hilton Portfolio of Brands.
WMBE Suppliers: Participation in Hilton's Supplier Diversity Program is voluntary – we process this information based on your consent and for our related legitimate business interests, including maintaining and enhancing our diversity program.
Qualifications & exceptions
Participation in the supplier diversity programme is voluntary.
The franchise and ownership processing covers brand promotion and communication between properties in the Portfolio.
Retention & Deletion · Company practice
Appendix A: retention of personal information for the purpose collected and any legal period
Within Appendix A, Hilton states that it retains personal information for the time necessary to accomplish the purpose for which it was collected, usually for the duration of any contractual relationship and for any period afterwards as legally required or permitted by applicable law, and that its retention policies reflect applicable limitation periods and legal requirements. This is the Appendix's retention statement, matching the purpose-based rule in the main body of the Statement.
Supporting quotations
Retention: We retain personal information about you for the time necessary to accomplish the purpose for which such information was collected, usually for the duration of any contractual relationship and for any period thereafter as legally required or permitted by applicable law.
Our retention policies reflect applicable statute of limitation periods and legal requirements.
Qualifications & exceptions
Retention is tied to the collection purpose, the contractual relationship, and any legally required or permitted period.
The Appendix restates the rule rather than listing per-category periods.
Legal Rights & Agreement Rules · Context
Data Subject Rights: some regional, national and state laws confer rights, shown in the portal
Appendix A states that some regional, national and state laws confer rights relating to personal data, as indicated in the Personal Data Requests Portal, and that residents of certain jurisdictions may have the rights it then lists. The scope of the rights is therefore stated to depend on the jurisdiction of the person, and the portal is said to indicate which rights apply.
Supporting quotations
Data Subject Rights
Some regional, national, and state laws confer rights relating to personal data as indicated in the Personal Data Requests Portal.
Residents of certain jurisdictions may have the following rights.
Access, Correction and Erasure Requests: You have the right to:
Qualifications & exceptions
The rights are stated as those that residents of certain jurisdictions may have.
The portal is said to indicate which rights apply.
Legal Rights & Agreement Rules · User right or choice
Access, correction and erasure requests
Within the Appendix A rights, the person has the right to ask Hilton to confirm whether it is processing their personal information and to receive information on how their data is processed; to obtain a copy of their personal information; to request that Hilton update or correct it; and to request that Hilton delete personal information in certain circumstances. The deletion right is qualified by 'in certain circumstances'.
Supporting quotations
ask us to confirm whether we are processing your personal information and receive information on how your data is processed
obtain a copy of your personal information
request that we update or correct your personal information
request that we delete personal information in certain circumstances
Qualifications & exceptions
The right to deletion applies only in certain circumstances.
The confirmation right includes receiving information on how the data is processed.
Legal Rights & Agreement Rules · User right or choice
Right to object to processing, including marketing, profiling and legitimate-interest processing
The person has the right to request that Hilton cease processing their personal information for marketing activities, including profiling; for statistical purposes; and where the processing is based on Hilton's legitimate business interests, unless Hilton can demonstrate a compelling legitimate basis for the processing or needs the information for the establishment, exercise or defence of a legal claim.
Supporting quotations
Right to Object to Processing: You have the right to request that Hilton cease processing of your personal information:
for marketing activities, including profiling
for statistical purposes
where such processing is based on our legitimate business interests, unless we are able to demonstrate a compelling legitimate basis for such processing or we need to process your personal information for the establishment, exercise or defense of a legal claim
Qualifications & exceptions
The objection to legitimate-interest processing is subject to a compelling legitimate basis or a legal-claims exception.
Profiling is included within the marketing ground.
Legal Rights & Agreement Rules · User right or choice
Right to restrict processing, and notice before processing resumes
The person may request that Hilton limit the processing of their personal information while Hilton is evaluating or responding to a request to update or correct the information where the processing is unlawful and the person does not want the data deleted; where Hilton no longer requires the data but the person wants it retained for the establishment, exercise or defence of a legal claim; and where the person has objected to processing based on legitimate business interests and Hilton's response is pending. Hilton says that where it limits processing at the person's request, it will inform the person before re-engaging in that processing.
Supporting quotations
Right to Restrict Processing: You have the right to request that Hilton limit the processing of your personal information:
while Hilton is evaluating or in the process of responding to a request by you to update or correct your personal information where such processing is unlawful and you do not want Hilton to delete your data
where Hilton no longer requires such data, but you want us to retain the data for the establishment, exercise or defense of a legal claim
where you have submitted an objection to processing based on our legitimate business interests, pending our response to such request
Where we limit the processing of your personal information pursuant to your request, we will inform you prior to re-engaging in such processing.
Qualifications & exceptions
Each ground is a specific situation; the right is not a general pause on processing.
Hilton says it will inform the person before re-engaging in the limited processing.
Legal Rights & Agreement Rules · User right or choice
Right to opt out of sale and sharing, and the device scope of a cookie opt-out
In the Appendix A rights, the person has the right to request that Hilton not sell or share their personal information, and may submit the request through the Hilton Opt-out request page, the 'Your Privacy Choices | Cookie Information' link on the Hilton.com website — shown when the site is accessed from an IP address indicating presence in a region with a privacy law — or the datarights.hilton.com portal, and also by telephone, email or post to the Data Protection Office. The Statement adds that a cookie, tag and pixel opt-out applies only to the device and browser used, that the person must opt out again on each other device or browser, and that a legally recognized browser-based opt-out preference signal turned on in the device browser is recognized in accordance with applicable law.
Supporting quotations
Right to Opt Out of Sale and Sharing: You have the right to request that Hilton not sell or share your personal information.
when you opt out of Cookies, tags, and pixels, that opt out only pertains to the device and the browser that you are using when you opt out.
if you have a legally-recognized browser-based opt-out preference signal turned on via your device browser, we recognize such preference in accordance with applicable law.
Qualifications & exceptions
A cookie-based opt-out is device- and browser-specific and must be repeated on each device.
A legally recognized browser-based opt-out preference signal is recognized in accordance with applicable law.
Legal Rights & Agreement Rules · User right or choice
Data portability: a copy in a machine-readable format, limited to directly obtained data and consent or contract
The person may request that Hilton provide them, or a third party they designate, with certain of their personal information in a commonly used, machine-readable format. Hilton states two limits: data portability rights apply only to personal information obtained directly from the person, and only where the processing is based on consent or on the performance of a contract.
Supporting quotations
Data Portability Requests: You have the right to request that we provide you or a third party that you designate with certain of your personal information in a commonly used, machine readable format.
data portability rights apply only to personal information that we have obtained directly from you and only where our processing is based on consent or the performance of a contract
Qualifications & exceptions
Portability is limited to personal information obtained directly from the person.
Portability applies only where processing is based on consent or on the performance of a contract.
The person may designate a third party recipient.
Legal Rights & Agreement Rules · Procedure
Submitting requests in Appendix A, identity verification, and the effect of a deletion request on services
Requests under the Appendix A rights may be submitted through the Data Subject Rights Request Portal, in writing to the Data Protection Office by email or post, and the person may also update their information as described in the main body's Your Rights and Choices section. Hilton says it will take reasonable steps to verify the identity and the request, including by checking account information, residency or the email address provided, that an authorized agent may have to produce written authorization, and that it will not respond unless it can appropriately verify the requester's identity. It says it will respond within the period permitted by law, that applicable law may give a right not to be discriminated against for exercising rights, that some information may be exempt — for example information retained for legal compliance and to secure the services — and that if the person asks for information Hilton needs to provide the services to be deleted, the person may no longer be able to use the services. It may also charge a reasonable fee for subsequent copies of data.
Supporting quotations
Submitting Requests: Your requests may be submitted by accessing the Data Subject Rights Request Portal at
or in writing to DataProtectionOffice@hilton.com
We will take reasonable steps to verify your identity and requests, including by verifying your account information, residency or the email address you provide.
We will not respond to any request unless we are able to appropriately verify the requester’s identity.
We will respond to all such requests within the time period permitted by law.
certain personal information may be exempt from such rights pursuant to applicable data protection laws, such as information we retain for legal compliance and to secure our services.
We may need certain information in order to provide the services to you; if you ask us to delete it, you may no longer be able to use the services.
In addition, we may charge you a reasonable fee for subsequent copies of data that you request.
Qualifications & exceptions
Hilton will not respond unless it can appropriately verify the requester's identity.
Some information may be exempt from the rights, including information retained for legal compliance and to secure the services.
Deleting information Hilton needs to provide the services may end the person's use of them.
A fee may be charged for subsequent copies of data requested.
Legal Rights & Agreement Rules · User right or choice
Complaining about data practices or the exercise of rights: Hilton or the supervisory authority
Hilton states that a person who wants to present a complaint or has concerns about its data practices, or about the exercise of their rights, may either contact Hilton at the Data Protection Office email address or the supervisory authority in the Member State of the person's residence. It says that for the EEA the supervisory authorities are listed on the European Data Protection Board page, and that for the UK the supervisory authority is the Information Commissioner's Office, linked from the Statement.
Supporting quotations
If you want to present a complaint or have concerns about our data practices or the exercise of your rights, you may either contact Hilton at DataProtectionOffice@Hilton.com
or the supervisory authority in the Member State of your residence.
For the EEA, the supervisory authorities are available
For the UK, the supervisory authority is available
Qualifications & exceptions
The complaint route depends on residence: the supervisory authority of the Member State of residence.
The Statement links to the EEA list of authorities and to the UK authority; their content is outside this document.
Legal Rights & Agreement Rules · User right or choice
Appeal rights in thirteen US states
Hilton states that residents of Colorado, Connecticut, Delaware, Iowa, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas and Virginia may appeal the denial of a request by emailing the Data Protection Office or mailing the Hilton Data Protection Office in McLean, Virginia. The appeal right is stated for those thirteen states only, and by those two routes.
Supporting quotations
Additionally, Colorado, Connecticut, Delaware, Iowa, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, and Virginia residents may appeal the denial of a request by emailing us at DataProtectionOffice@hilton.com
or mailing us at Hilton Data Protection Office, 7930 Jones Branch Drive, McLean, VA 22102, USA.
Qualifications & exceptions
The appeal right is listed for thirteen named US states.
The appeal is made by email or post to the Data Protection Office, not through the portal.
Legal Rights & Agreement Rules · User right or choice
Right to withdraw consent, including for direct marketing
Hilton states that the person has the right to withdraw consent to any processing it conducts solely on the basis of consent, giving direct marketing materials to the personal email account as the example, and that consent to marketing activities may be withdrawn by following the instructions on any marketing emails received or by contacting the Data Protection Office email address. The right is limited to processing conducted solely on consent.
Supporting quotations
Right to Withdraw Consent: You have the right to withdraw your consent to any processing that we conduct solely based on your consent (such as sending direct marketing materials to your personal email account).
You may withdraw your consent to marketing activities by following the instructions on any marketing emails you receive, or contacting DataProtectionOffice@hilton.com
Qualifications & exceptions
The right covers only processing conducted solely on the basis of consent.
Two withdrawal routes are given: the instructions in a marketing email, or contacting the Data Protection Office.
Legal Rights & Agreement Rules · User right or choice
Right to object to profiling and automated decision making
Hilton states that the person has the right to object to profiling and automated decision making, and explains that it uses personal information to divide large groups of consumers into sub-groups, known as segments, based on shared characteristics such as geography, behaviour or demographics. It adds that with the person's consent it makes automated decisions, meaning decisions without human interference, to offer certain benefits based on the person's characteristics — such as discounted room rates or other special offers based on geography, behaviour or demographics — with the example that frequent weekday travel to hotels in France may bring special offers for Hilton hotels in France.
Supporting quotations
Right to Object to Profiling and Automated Decision Making: You have the right to object to profiling and automated decision making.
We use personal information to divide large groups of consumers into sub-groups of consumers (known as segments) based on some type of shared characteristics such as geography, behavior, or demographics.
With your consent, we make automated decisions, meaning without human interference, to offer you certain benefits based on your characteristics (such as discounted room rates or other special offers based on your geography, behavior, or demographics).
if you travel frequently during the week to hotels in France, we may send you special offers for Hilton hotels in France
Qualifications & exceptions
Automated decisions are made with the person's consent.
The benefit examples are 'such as' items, and the France travel example is an illustration.
Profiling is described as grouping consumers into segments on shared characteristics.
Sharing & Disclosure · Company practice
Appendix A: international transfers of personal information, to the United States, with safeguards
In the Appendix A rights, Hilton states that it may transfer the personal information it collects to countries that have not been found to provide adequate protection of data under a country-specific law, and in particular that it transfers personal information to the United States. It says it uses appropriate safeguards for transfers among its affiliates in various jurisdictions and, where required, has implemented data transfer agreements, such as the European Commission standard contractual clauses or similar safeguards, and that a copy of the clauses or further information on transfers can be requested at privacy@hilton.com.
Supporting quotations
International Data Transfers: We may transfer the personal information we collect about you pursuant to the purposes described in this Statement to countries that have not been found to provide adequate protection of data pursuant to a country-specific law.
In particular, we transfer your personal information to the United States.
We use appropriate safeguards for the transfer of personal information among our affiliates in various jurisdictions, and where required, we have implemented data transfer agreements, such as the European Commission standard contractual clauses or other similar safeguards for such purposes.
To obtain a copy of theses clauses or additional information on transfers, you may send your request to privacy@hilton.com
Qualifications & exceptions
The transfer to the United States is stated as a fact, not as a possibility.
Data transfer agreements are stated to be implemented where required.
The safeguards are described as appropriate safeguards, and the clauses as the European Commission standard contractual clauses 'or other similar safeguards'.
Legal Rights & Agreement Rules · Context
Appendix A-1: California residents — CCPA information and the sections it cross-refers to
The California appendix says that California law requires Hilton to give additional information about how it collects, uses and discloses 'personal information' as defined in the California Consumer Privacy Act, and that Hilton describes the categories of information collected, the business purposes for collection, the sources and uses, and the entities with which it discloses information in the 'Collection of Personal Information – Generally', 'Collection of Personal Information – Notice at Point of Collection', 'Cookies and Other Technologies' and 'How We Disclose Personal Information' sections of the Statement. The California appendix therefore works by cross-reference to the main body rather than repeating it.
Supporting quotations
Appendix A-1: California Residents
The law in California requires us to provide you with some additional information regarding how we collect, use, and disclose your “personal information” as defined in the California Consumer Privacy Act (“CCPA”).
We describe the categories of information we collect, our business purposes for collecting such information, the sources and uses of such information and the entities with which we disclose such information in the
"Cookies and Other Technologies," and "How We Disclose Personal Information" sections of this Statement.
Qualifications & exceptions
The appendix cross-refers to four sections of the main body instead of restating them.
'Personal information' is stated to carry the meaning given in the California Consumer Privacy Act.
Sharing & Disclosure · Company practice
California: the categories shared for targeted advertising, which may constitute a sale
Hilton states that it engages in targeted, or cross-context behavioural, advertising on its services or on other sites and when it advertises its services elsewhere, and that in connection with such advertising it may share categories of information with advertising networks and providers, advertisers and social media networks, which may be considered a sale under California law and is the processing of personal information for targeted advertising. The categories listed are device information and identifiers such as IP address, unique advertising identifiers and cookies; hashed identifiers such as contact information; usage information such as browsing history or app usage; location information such as city; and inference data.
Supporting quotations
Sale or Sharing of Personal Information
We engage in targeted (or cross context behavioral) advertising on our services or on other sites and when we advertise our services elsewhere.
we may share the following categories of information with advertising networks and providers, advertisers, and social media networks, which may be considered a sale under California law and is the processing of personal information for targeted advertising: device information and identifiers, such as IP address, and unique advertising identifiers and cookies; hashed identifiers such as contact information, usage information, such as browsing history or app usage; location information, such as city; and inference data.
Qualifications & exceptions
The sharing 'may be considered a sale under California law' and is the processing for targeted advertising.
The category list includes hashed contact information, not contact information itself.
Legal Rights & Agreement Rules · Restriction or exception
California: no sale or sharing of a consumer's information where Hilton knows they are under 16
Hilton states that it does not 'sell' or 'share' personal information, as those terms are defined under the CCPA, if it has actual knowledge that the consumer is less than 16 years of age. The rule is a prohibition tied to actual knowledge of the consumer's age, and it applies to the sale and sharing definitions in the CCPA rather than to collection generally.
Supporting quotations
We do not “sell” or “share” personal information (as those terms are defined under the CCPA) if we have actual knowledge that the consumer is less than 16 years of age.
Qualifications & exceptions
The prohibition applies only where Hilton has actual knowledge that the consumer is under 16.
The terms 'sell' and 'share' are the CCPA definitions.
Legal Rights & Agreement Rules · Company practice
Appendix A rights: response time, exemptions from the rights, service limits and copy fees
Hilton says it will respond to all such requests within the time period permitted by law, and that applicable law may give the person a right not to be discriminated against for exercising their rights. It adds three qualifications: certain personal information may be exempt from the rights under applicable data protection laws, such as information Hilton retains for legal compliance and to secure its services; Hilton may need certain information in order to provide the services, so a request to delete it may mean the person can no longer use those services; and Hilton may charge a reasonable fee for subsequent copies of data requested.
Supporting quotations
We will respond to all such requests within the time period permitted by law.
Applicable law may further provide you with the right to not be discriminated against for exercising your rights.
certain personal information may be exempt from such rights pursuant to applicable data protection laws, such as information we retain for legal compliance and to secure our services.
We may need certain information in order to provide the services to you; if you ask us to delete it, you may no longer be able to use the services.
In addition, we may charge you a reasonable fee for subsequent copies of data that you request.
Qualifications & exceptions
The response period is the one permitted by law.
Exempt information includes what Hilton retains for legal compliance and to secure its services.
Deleting information needed to provide the services may end the person's use of them.
The fee applies to subsequent copies of data requested.
Legal Rights & Agreement Rules · User right or choice
California: the three CCPA rights, in addition to the Appendix A rights
Hilton states that, in addition to certain rights described in Appendix A for residents of certain countries and US states, the California Consumer Privacy Act affords California consumers three rights: the right to know what personal information Hilton collects, uses, discloses and/or sells; the right to request that it delete their personal information; and the right to request that it no longer sell or share their personal information. The California rights are stated as additional to the Appendix A rights, not as a substitute for them.
Supporting quotations
The Right to Know, The Right to Delete, and the Right to Opt-Out of the Sale or Sharing of Personal Information
the California Consumer Privacy Act (“CCPA”) affords California consumers (1) the right to know what personal information we collect, use, disclose, and/or sell; (2) the right to request that we delete their personal information; and (3) the right to request that we no longer sell or share their personal information.
Qualifications & exceptions
The three CCPA rights are stated as additional to the Appendix A rights.
The right to know covers collection, use, disclosure and sale.
Legal Rights & Agreement Rules · Procedure
California: where to send a request for information, correction or deletion
Hilton directs a person who wants information about the personal information it collects, or who wants to request correction or deletion, to the Data Subject Rights Portal, and also gives a toll-free telephone number, the Data Protection Office email address and a postal address in McLean, Virginia. The same DPO contact point serves the California and Appendix A routes.
Supporting quotations
If you would like information about the personal information that we collect, or if you would like to make a request for us to correct or delete your personal information, please visit Data Subject Rights Portal at
You also may call our toll-free telephone number: (800) 413-7470, email the Data Protection Office (“DPO”) at DataProtectionOffice@hilton.com
send a letter to the Data Protection Office at 7930 Jones Branch Drive, McLean, Virginia, USA 22102.
Qualifications & exceptions
The stated telephone number and postal address are in the United States.
The portal is the first route given.
Legal Rights & Agreement Rules · Procedure
California: identity verification before a request is fulfilled, and how to appoint an agent
Hilton states that when the DPO receives a request it first verifies the person's identity: for a Hilton Honors member, by asking for the name, the Honors account number and the email address and phone number associated with the account; for someone who is not a member, by asking for the name, the email address and/or phone number associated with a past stay and potentially a confirmation number from a stay. Once identity is verified, the DPO says it will promptly fulfil the request. A person may designate an authorized agent, and to do so must submit a court order, a document submitted by a barred attorney, or a formal certified document issued by an official governmental agency.
Supporting quotations
When the DPO receives your request, the DPO will first verify your identity.
If you are a Hilton Honors member, the DPO will verify your identity by asking you to provide your name, Hilton Honors account number, and the email address and phone number associated with your Hilton Honors account.
If you are not a Hilton Honors member, the DPO will verify your identity by asking you to provide your name, the email address and/or phone number associated with a past stay, and potentially a confirmation number from one of your stays at a Hilton property.
Once the DPO has verified your identity, the DPO will promptly fulfill your request.
If you would like, you may designate an authorized agent to make a request on your behalf.
please submit an order issued by a court, a document submitted by a barred attorney, or a formal certified document issued by an official governmental agency.
Qualifications & exceptions
Identity verification comes before the request is fulfilled.
The authorized-agent appointment requires one of three kinds of formal document.
The confirmation number is described as something the DPO 'potentially' asks for.
Legal Rights & Agreement Rules · User right or choice
California: opting out of sale or sharing, and the Global Privacy Control
Hilton states that a person who wants to opt out of the sale or sharing of their personal information may submit the request through the 'Your Privacy Choices | Cookie Information' link at the bottom of the Hilton.com website, shown when the site is accessed from an IP address indicating presence in a state that has enacted a privacy law. A cookie, tag and pixel opt-out applies only to the device and browser used, so the person must opt out again on each other device or browser. California residents can also turn on the Global Privacy Control to opt out of the browser-based 'sale' or 'sharing' for each participating browser system. The Statement notes that a cookie blocker such as Ghostery may hide the Your Privacy Choices tool or link, including in the web footer, and that California consumers may separately request that Hilton no longer sell or share non-cookie based personal information by making a Hilton Opt-out request.
Supporting quotations
If you would like to opt out of the sale or sharing of your personal information, you may submit a request by clicking the “ Your Privacy Choices| Cookie Information” link at the bottom of the Hilton.com website
when you opt out of cookies, tags, and pixels, that opt out only pertains to the device and the browser that you are using when you opt out.
California residents can also turn on the Global Privacy Control (GPC) to opt out of the “sale” or “sharing” of your personal information that is browser based for each participating browser system that you use.
If you use a cookie blocker such as Ghostery, it may block visibility of the Your Privacy Choices tool or link, including in your web footer.
California consumers may request that we no longer sell or share non-cookie based personal information by making a Hilton Opt-out request
Qualifications & exceptions
A cookie-based opt-out is device- and browser-specific and must be repeated on each device.
The Global Privacy Control covers browser-based sale or sharing for each participating browser system.
A cookie blocker may hide the opt-out tool, which is why a separate non-cookie opt-out request exists.
The 'Your Privacy Choices' link appears only when the IP address indicates a state with a privacy law.
Legal Rights & Agreement Rules · Restriction or exception
California: use of sensitive personal information is limited to what the services or the law require
Hilton states that it limits the use of a California consumer's sensitive personal information to the use necessary to perform reasonably expected services or as required by law, and that California's right to limit the use and disclosure of sensitive personal information therefore does not apply to it. The statement is framed as a limitation on Hilton's own use, with the statutory right said not to apply on that basis.
Supporting quotations
Sensitive Personal Information
We limit the use of your sensitive personal information to that use which is necessary to perform reasonably expected services or as required by law, to which California’s right to limit the use and disclosure of sensitive personal information does not apply.
Qualifications & exceptions
The limitation is to use necessary for reasonably expected services or as required by law.
The right to limit use and disclosure is stated not to apply because of that limitation.
Legal Rights & Agreement Rules · User right or choice
California: requesting information about disclosures for direct marketing, once a year
Hilton states that California consumers may request information about its disclosures of certain categories of personal information to third parties for their direct marketing purposes, and that such requests must be sent to the California privacy or Data Protection Office email addresses, or by post to the Data Protection Office in McLean, Virginia. Within thirty days of receiving such a request, Hilton says it will provide the list of categories of personal information disclosed to third parties for third-party direct marketing purposes during the immediately preceding calendar year, together with the names and addresses of those third parties. The request may be made no more than once per calendar year, and Hilton reserves the right not to respond to requests sent to addresses other than the ones specified.
Supporting quotations
Direct Marketing/Shine the Light Disclosure
California consumers also may request information about our disclosures of certain categories of personal information to third parties for their direct marketing purposes.
Within thirty days of receiving such a request, we will provide a list of the categories of personal information disclosed to third parties for third-party direct marketing purposes during the immediately preceding calendar year, along with the names and addresses of these third parties.
This request may be made no more than once per calendar year.
We reserve our right not to respond to requests submitted to addresses other than the addresses specified in this paragraph.
Qualifications & exceptions
The response is due within thirty days and covers the immediately preceding calendar year.
The request may be made no more than once per calendar year.
Hilton reserves the right not to respond to requests sent to other addresses.
The disclosure covered is for third-party direct marketing purposes.
Legal Rights & Agreement Rules · Company commitment
California: no discrimination for exercising CCPA rights
Hilton states that the CCPA prohibits a business from treating a consumer differently because the consumer exercised a right conferred by the CCPA, that it welcomes people to exercise their rights under the CCPA, and that it will not discriminate against them for doing so. The commitment is framed as non-discrimination, not as an extension of the rights themselves.
Supporting quotations
The Right to Non-Discrimination
The CCPA prohibits a business from treating a consumer differently because the consumer exercised a right conferred on him/her by the CCPA.
we will not discriminate against you for doing so.
Qualifications & exceptions
The commitment is to non-discrimination, not to a wider set of rights.
Legal Rights & Agreement Rules · Company practice
California: no financial incentive for collecting, selling or deleting personal information
Hilton states that it does not offer a financial incentive for the collection, sale or deletion of personal information, and explains that it primarily collects personal data from guests in order to fulfil guest reservations and from Honors members in order to operate the Hilton Honors loyalty programme, while also collecting personal data for marketing and other purposes as permitted by applicable law. The statement is the notice required where a business offers a financial incentive, and Hilton says it offers none.
Supporting quotations
Financial Incentive Notice
Hilton does not offer a financial incentive for the collection, sale, or deletion of personal information.
Hilton primarily collects personal data from guests in order to fulfill guest reservations and from Honors members in order to operate the Hilton Honors loyalty program.
Hilton also collects personal data for marketing and other purposes as permitted by applicable law.
Qualifications & exceptions
The main collection purposes are given as reservation fulfilment and operating the loyalty programme, with marketing and other purposes as permitted by law.
The notice covers collection, sale and deletion.
Legal Rights & Agreement Rules · Company practice
California: accumulating Honors points and discounted rates are not a financial incentive
Hilton states, referring to the Hilton Honors Terms and Conditions, that Hilton Honors members can accumulate points and access discounted rates, and that the ability to accumulate points and access discounted rates is not directly related to the value provided to the business of members' data. The Terms and Conditions are a separate document whose text this source does not supply, so the Statement's own explanation is what can be read here.
Hilton Honors members have the ability to accumulate points and access discounted rates.
The ability to accumulate points and to access discounted rates is not directly related to the value provided to the business of members’ data.
Qualifications & exceptions
The statement is that the points and discounted rates are 'not directly related' to the value of members' data.
The underlying terms are in the Hilton Honors Terms and Conditions, which this source does not contain.
Not stated here
The linked Hilton Honors Terms and Conditions are not supplied in this source, so this card cannot say what those terms provide beyond the reference the Statement itself makes.
Legal Rights & Agreement Rules · User right or choice
California: request to remove publicly posted content if you are under 18
Hilton states that if a person is a California resident under the age of 18 and a registered user of any site where the policy is posted, California Business and Professions Code Section 22581 permits them to request and obtain removal of content or information they have publicly posted, and the request is made by emailing a detailed description of the specific content to CA_Privacy@Hilton.com. It warns that such a request does not ensure complete or comprehensive removal, and that there may be circumstances in which the law does not require or allow removal even if requested.
Supporting quotations
Removal of Content
If you are a California resident under the age of 18, and a registered user of any site where this policy is posted, California Business and Professions Code Section 22581 permits you to request and obtain removal of content or information you have publicly posted.
Please be aware that such a request does not ensure complete or comprehensive removal of the content or information you have posted and that there may be circumstances in which the law does not require or allow removal even if requested.
Qualifications & exceptions
The right is stated for California residents under 18 who are registered users of a site where the policy is posted.
The request is made by email with a detailed description of the specific content.
Removal is not guaranteed and the law may not require or allow it even when requested.
Retention & Deletion · Context
California: retention is governed by the main body's Data Retention Periods section
The California appendix does not restate a retention rule; it directs the reader to the section titled Data Retention Periods in the main body of the Statement. The retention commitment is therefore the main body rule, which keeps personal information for as long as the collection purpose requires, usually the duration of the contractual relationship plus any legally required or permitted period.
Supporting quotations
Retention of Your Personal Information
Please refer to the section titled Data Retention Periods in the main body of this Statement.
Qualifications & exceptions
The appendix cross-refers to the main body rather than adding a California-specific period.
Legal Rights & Agreement Rules · Company practice
California: Do Not Track signals are not responded to
Hilton states that California law requires it to tell people how it responds to web browser Do Not Track signals, and that because there is currently no industry or legal standard for recognising or honouring DNT signals, it does not respond to them at this time. The main body's advertising section says the same, and separately says that legally recognised global opt-out signals are honoured.
Supporting quotations
Do Not Track (“DNT”)
California law requires us to let you know how we respond to web browser Do Not Track (“DNT”) signals.
Because there currently isn’t an industry or legal standard for recognizing or honoring DNT signals, we don’t respond to them at this time.
Qualifications & exceptions
The reason given is the absence of an industry or legal standard for recognising or honouring DNT signals.
The commitment is expressed as 'at this time', so it is not a permanent statement.
Use & Processing · Company practice
Generative AI training data: the Digital Assistant, its training data and the sources used
Hilton states that California's Generative Artificial Intelligence Training Data Transparency Act requires developers of GenAI systems available to California residents to post details on the data used to train their systems. It describes the Hilton Digital Assistant as a GenAI chatbot available to the public on Hilton.com, through the Hilton Honors app and through guest messaging channels at certain hotels, which can assist with customer support tasks and produce context-aware answers about account support, reservation details, hotel information and general inquiries. It says it developed the assistant using Hilton proprietary datasets, that the training data is internally sourced and collected on an ongoing basis, that it does not use synthetic data generation, and that the datasets do not include personal information or aggregated consumer information as defined in the CCPA. It began using this data to develop the assistant on August 1, 2021.
Supporting quotations
Generative Artificial Intelligence Training Data Transparency
California’s Generative Artificial Intelligence (GenAI) Training Data Transparency Act requires developers of GenAI systems available to California residents to post details on the data used for training their systems on their websites.
Hilton Digital Assistant is a GenAI chatbot that is available to the public on our website (Hilton.com
Hilton Digital Assistant is a GenAI chatbot that is available to the public on our website (Hilton.com
Hilton developed the Hilton Digital Assistant using Hilton proprietary datasets. The data used to train the Hilton Digital Assistant is internally sourced and collected on an ongoing basis.
We do not use synthetic data generation. The datasets do not include personal information or aggregated consumer information as defined in the CCPA.
We began using this data to develop the Hilton Digital Assistant on August 1, 2021.
Qualifications & exceptions
The training data is internally sourced and collected on an ongoing basis.
No synthetic data generation is used.
The datasets exclude personal information and aggregated consumer information as defined in the CCPA.
Use of the data for development began on August 1, 2021.
Use & Processing · Context
GenAI training data: the Policy and General Knowledgebase dataset
The training-data summary lists a dataset called Policy and General Knowledgebase. Its source and owner is Hilton; the data type is support content aimed at answering questions about Hilton programs and supporting the management of reservations; the estimated volume is 10,000; and the intellectual property status is Hilton Proprietary.
Supporting quotations
Policy and General Knowledgebase
Source/Owner of Datasets
Hilton
Description of Data Type
Support content aimed to answer questions about Hilton programs and support for managing reservations.
Estimated Volume
10,000
Intellectual Property Status
Hilton Proprietary
Qualifications & exceptions
The volume is given as an estimate.
The intellectual property status is stated to be Hilton Proprietary.
Use & Processing · Context
GenAI training data: the Hotel Information System dataset
The training-data summary lists a dataset called Hotel Information System. Its source and owner is Hilton; the data type is hotel amenities and policies, for example pool availability, parking cost and pet policies; the estimated volume is 1 million; and the intellectual property status is Hilton Proprietary.
Supporting quotations
Hotel Information System
Source/Owner of Datasets
Hilton
Description of Data Type
Hotel amenities and policies. E.g. Pool Availability, Parking Cost, Pet Policies.
Estimated Volume
1 million
Intellectual Property Status
Hilton Proprietary
Qualifications & exceptions
The volume is given as an estimate.
The examples given are amenity and policy information such as pool availability, parking cost and pet policies.
Legal Rights & Agreement Rules · User right or choice
Nevada residents: requesting that Hilton stop selling certain categories of personal information
The Nevada appendix states that a Nevada resident may request that Hilton stop selling certain categories of personal information that it collects, and gives the routes: the opt-out request page on Hilton's website, the toll-free telephone number, the Data Protection Office email address, or a letter to the Data Protection Office in McLean, Virginia. It then repeats the identity verification: for a Hilton Honors member the DPO asks for the name, account number and account email and phone number, for a non-member for the name, contact details associated with a past stay and potentially a stay confirmation number, and once identity is verified the DPO says it will promptly fulfil the request.
Supporting quotations
Appendix A-2: Nevada Residents
If you are a Nevada resident, you may request that we stop selling certain categories of personal information that we collect.
When the DPO receives your request, the DPO will first verify your identity.
If you are a Hilton Honors member, the DPO will verify your identity by asking you to provide your name, Hilton Honors account number, and the email address and phone number associated with your Hilton Honors account.
Once the DPO has verified your identity, the DPO will promptly fulfill your request.
Qualifications & exceptions
The right covers 'certain categories' of personal information that Hilton collects, not all of it.
Identity verification precedes fulfilment, with different evidence for members and non-members.
Legal Rights & Agreement Rules · Restriction or exception
French residents: phone number collection, no telemarketing, and the telephone canvassing opposition list
The French appendix states that, as disclosed in the Statement, Hilton may collect a French resident's phone number to fulfil guest reservations, send reservation communications, provide customer service and support, verify identity, send marketing communications by SMS, process transactions with partners, share data with Hilton's Third-Party Partner, authenticate mobile accounts, send service-related SMS communications, detect and prevent fraud, and engage in sales activity for group bookings. It adds that Hilton will not use the phone number for telemarketing, and that a person who wishes to register on the list of opposition to telephone canvassing may do so on the French Bloctel site. This is a France-specific statement; it is not the rule stated in the main body of the global Statement.
Supporting quotations
Appendix A-3: French Residents
This Appendix provides additional information for individuals residing in France.
French residents, as disclosed in this Statement, we may collect your phone number to fulfill guest reservations, send guests communications relating to their reservations, provide customer service and support, verify identity, send marketing communications via SMS, process transactions with partners, share data with Hilton’s Third-Party Partner, authenticate mobile accounts, send service-related SMS communications, detect and prevent fraud, and engage in sales activities for group bookings.
We will not use your phone number for telemarketing.
if you would like to register on the list of opposition to telephone canvassing, you may do so at www.bloctel.gouv.fr
Qualifications & exceptions
The no-telemarketing statement and the Bloctel reference are specific to French residents.
The purposes listed are those the Statement already discloses for the phone number, restated for France.
The Bloctel registration is an external route Hilton points to rather than a process it runs.
Legal Rights & Agreement Rules · User right or choice
Hong Kong residents: consent before marketing messages, and unsubscribe at any time
The Hong Kong appendix states that if a person is based in Hong Kong SAR, China, Hilton will obtain consent on or before sending any marketing messages, and that they may opt out of receiving marketing messages at any time by using the unsubscribe link in those messages. The consent requirement is stated for people based in Hong Kong SAR, China; the main body of the global Statement says consent is obtained where required in the jurisdiction.
Supporting quotations
Appendix A-4: Hong Kong Residents
This Appendix provides additional information for individuals residing in Hong Kong SAR, China.
If you are based in Hong Kong SAR, China, we will obtain your consent on or before sending you any marketing messages.
You may opt out of receiving marketing messages from us at any time by using the unsubscribe link found in our marketing messages.
Qualifications & exceptions
The consent is obtained on or before sending the marketing message, and applies to people based in Hong Kong SAR, China.
Opting out is through the unsubscribe link in the marketing messages.
Legal Rights & Agreement Rules · User right or choice
Hong Kong: access or correction requests, further information for verification, and refusal
The Hong Kong appendix says that a person who wants to access or correct their personal information should contact the Data Protection Office or visit the Data Subject Rights Requests Portal. It states that Hilton may require further information from the requester in order to verify identity before processing the request, and that in certain circumstances where permitted under applicable law, Hilton may refuse to fulfil the request.
Supporting quotations
If you would like to access or correct your personal information, please contact the Data Protection Office (“DPO”) at DataProtectionOffice@hilton.com
We may require further information from you in order to verify your identity before processing your request.
In certain circumstances where permitted to do so under applicable law, we may refuse to fulfil your request.
Qualifications & exceptions
Further information may be required for identity verification before the request is processed.
Refusal is possible in certain circumstances where applicable law permits it.
Legal Rights & Agreement Rules · Context
Türkiye appendix: additional information and rights under local law, controlling over the main body
The Türkiye appendix states that for data subjects in Türkiye it outlines certain additional information Hilton is obliged to provide and certain rights they have with respect to the processing of their personal information, pursuant to applicable local laws, and that the appendix controls to the extent it conflicts with any provision in the main body of the Statement or in Appendix A. It is therefore a jurisdictional override within the global statement.
Supporting quotations
Appendix A-5: Türkiye Residents
For data subjects in Türkiye, this Appendix outlines certain additional information that Hilton is obligated to provide to you, as well as certain rights you have with respect to the processing of your personal information, pursuant to applicable local laws.
This Appendix will control to the extent it conflicts with any provision in the main body of this Statement, or Appendix A, as applicable.
Qualifications & exceptions
The appendix controls over both the main body and Appendix A where they conflict.
The information and rights are stated as those owed and available under applicable local laws.
Legal Rights & Agreement Rules · Company practice
Türkiye: the data controller for guest data, and local entities that may also be controllers
The Türkiye appendix names Hilton Domestic Operating Company Inc. as the Hilton entity for all guest data and for Hilton's marketing activities. It adds that a person's personal data may also be processed by other Hilton entities in Türkiye that act as a data controller based on the Hilton property they stay at, and that in such cases the relevant Hilton entity will act as the data controller and will provide a separate privacy notice where necessary. The controller for a given stay therefore depends on which property the person stays at.
Supporting quotations
Data Controller. Hilton Domestic Operating Company Inc. is the Hilton entity for all guest data and Hilton's marketing activities.
Your personal data may be processed by other Hilton entities in Türkiye who act as a data controller based on the Hilton property you stay at.
the relevant Hilton entity will act as the data controller for your personal data, who will provide you with a separate privacy notice, where necessary.
Qualifications & exceptions
The local entity's separate privacy notice is provided 'where necessary'.
The controller for a stay follows the property at which the person stays.
Legal Rights & Agreement Rules · Context
Türkiye: the data controller representative for questions and complaints
The Türkiye appendix says a person in Türkiye may contact Hilton's data controller representative in Türkiye by email or mail to handle questions and complaints about the processing of their personal data, and gives the representative as Esin Attorney Partnership, with the email address info@esin.av.tr and the postal address Akatlar Mah. Ebulula Mardin Cad. Gül Sok. No. 2. This is a local representative contact, separate from the Data Protection Office in Virginia.
Supporting quotations
Data Controller Representative. You may contact our data controller representative in Türkiye by email or mail to handle questions and complaints in connection with the processing of your personal data if you are in Türkiye.
Esin Attorney Partnership
info@esin.av.tr
Akatlar Mah. Ebulula Mardin Cad. Gül Sok. No. 2
Qualifications & exceptions
The representative handles questions and complaints about the processing of personal data in Türkiye.
The representative is a law firm named in the appendix.
Legal Rights & Agreement Rules · Company practice
Türkiye: the four legal bases relied on for the purposes in the Statement
The Türkiye appendix states that Hilton relies on the following legal bases when processing personal data for the purposes indicated in the Global Privacy Statement, in accordance with Article 5 of Law No. 6698 on Protection of Personal Data, referred to as the Data Protection Law: processing necessary because it is directly related to the conclusion or fulfilment of the contract between the person and Hilton; processing mandatory for Hilton to comply with its legal obligations; processing mandatory for Hilton's legitimate interests, provided it does not violate the person's fundamental rights and freedoms; or the person's explicit consent. It adds that it relies on explicit consent only when it requires consent for the processing, and does not rely on that ground when it relies on one of the others. The appendix cites the legal basis without setting out the law's terms.
Supporting quotations
Legal bases for the processing of your personal data. Hilton relies on the following legal bases while processing your personal data for the purposes indicated in the Global Privacy Statement in accordance with Article 5 of the Law No. 6698 on Protection of Personal Data (“Data Protection Law”):
processing of your personal data is necessary provided that it is directly related to the conclusion or fulfillment of the contract between you and Hilton;
processing is mandatory for Hilton to be able to comply with our legal obligations;
processing is mandatory for Hilton’s legitimate interests, provided that it does not violate your fundamental rights and freedoms; or
your explicit consent. (Please note that we rely on your explicit consent only when we require your consent for the processing and we do not rely on this legal basis if and when we rely on one of the other legal grounds above.)
Qualifications & exceptions
The legitimate-interest basis is qualified by the condition that it does not violate the person's fundamental rights and freedoms.
Explicit consent is relied on only where consent is required, and not as a substitute for the other grounds.
The citation names Article 5 of Law No. 6698; the appendix does not reproduce the law.
Legal Rights & Agreement Rules · Company practice
Türkiye: fulfilling guest reservations — data categories and legal basis
For the purpose of fulfilling guest reservations, the Türkiye appendix states that Hilton collected the following categories of personal data: name, telephone and fax numbers, email address, home address and Hilton Honors number, and that it relies on the contract as the legal basis for processing them. Only the contract basis is listed for this purpose.
Supporting quotations
We have collected personal data for the following purposes:
Fulfill guest reservations
We collected the following categories of personal data for this purpose:
Name
Telephone and fax numbers
Email address
Home address
Hilton Honors number
We rely on the following legal bases to process personal data:
Contract
Qualifications & exceptions
Only the contract legal basis is listed for this purpose.
The data categories are the ones the appendix states were collected for this purpose.
Legal Rights & Agreement Rules · Company practice
Türkiye: reservation communications — data categories and legal bases
For the purpose of sending guests communications about reservations, the Türkiye appendix states that Hilton collected name, telephone and fax numbers, email address and Hilton Honors number, and that it relies on the contract and legitimate interests as the legal bases for processing them. The home address collected for reservations is not listed for this purpose.
Supporting quotations
Send guests communications about reservations
We collected the following categories of personal data for this purpose:
Name
Telephone and fax numbers
Email address
Hilton Honors number
We rely on the following legal bases to process personal data:
Contract
Legitimate interests
Qualifications & exceptions
Two legal bases are listed for this purpose: contract and legitimate interests.
The home address is not among the categories listed for this purpose.
Legal Rights & Agreement Rules · Company practice
Türkiye: administering Hilton Honors membership — data categories and legal bases
For the purpose of administering Hilton Honors membership and activity, the Türkiye appendix states that Hilton collected name, email address, home address and Hilton Honors number, and that it relies on the contract and legitimate interests as the legal bases. Unlike the reservation purpose, telephone and fax numbers are not listed for this purpose.
Supporting quotations
Administer Hilton Honors membership and activity
We collected the following categories of personal data for this purpose:
Name
Email address
Home address
Hilton Honors number
We rely on the following legal bases to process personal data:
Contract
Legitimate interests
Qualifications & exceptions
Two legal bases are listed: contract and legitimate interests.
Telephone and fax numbers are not among the categories listed for this purpose.
Legal Rights & Agreement Rules · Company practice
Türkiye: customer service and support — data categories and legal bases
For the purpose of providing customer service and support, the Türkiye appendix states that Hilton collected name, telephone and fax numbers, email address, home address, Hilton Honors number, WeChat name and profile photo, arrival time, corporate travel planner contact information, booking engine data, and whether the person holds a Hilton and American Express co-branded credit card and whether their Hilton and Amazon and Hilton and Lyft accounts are linked. It relies on the contract and legitimate interests as the legal bases. This is the widest list of data categories in the Türkiye purposes shown so far.
Supporting quotations
Provide customer service and support
We collected the following categories of personal data for this purpose:
Name
Telephone and fax numbers
Email address
Home address
Hilton Honors number
WeChat name and profile photo
Arrival time
Corporate travel planner contact information (name, title, company, business phone, email and address)
Qualifications & exceptions
Two legal bases are listed: contract and legitimate interests.
The list includes inferences about linked partner accounts, not only contact details.
Legal Rights & Agreement Rules · Company practice
Türkiye: customer service — partner account indicators and the legal bases
The remainder of the customer service and support list in the Türkiye appendix records booking engine data, whether the person has a Hilton and American Express co-branded credit card, whether their Hilton and Amazon accounts are linked and whether their Hilton and Lyft accounts are linked, and states that the legal bases for this purpose are the contract and legitimate interests.
Supporting quotations
Booking engine
Whether you have a Hilton and American Express Co-Branded Credit Card
Whether your Hilton and Amazon accounts are linked
Whether your Hilton and Lyft accounts are linked
We rely on the following legal bases to process personal data:
Contract
Legitimate interests
Qualifications & exceptions
The legal bases listed for this purpose are the contract and legitimate interests.
The three partner items are recorded as whether statements rather than as content.
Legal Rights & Agreement Rules · Company practice
Türkiye: verifying identity — data categories collected
For the purpose of verifying identity, the Türkiye appendix states that Hilton collected name, telephone and fax numbers, email address and home address. The legal bases listed for this purpose follow in the next part of the appendix.
Supporting quotations
Verify identity
We collected the following categories of personal data for this purpose:
Name
Telephone and fax numbers
Email address
Home address
Qualifications & exceptions
Only the collected data categories are stated in this part; the legal bases are listed in the following part of the appendix.
Legal Rights & Agreement Rules · Company practice
Türkiye: legal basis for verifying identity is legitimate interests
The Türkiye appendix lists one legal basis for processing the identity data it collected to verify identity: legitimate interests. The data categories for this purpose were name, telephone and fax numbers, email address and home address, as stated in the preceding part of the appendix.
Supporting quotations
We rely on the following legal bases to process personal data:
Legitimate interests
Qualifications & exceptions
Legitimate interests is the only legal basis listed for this purpose.
Legal Rights & Agreement Rules · Company practice
Türkiye: sending marketing communications — data categories and legal basis
For the purpose of sending email, direct mail and social media marketing communications, the Türkiye appendix states that Hilton collected name, Hilton Honors number and corporate travel planner contact information, and that consent is the legal basis relied on. This is the only purpose in the Türkiye list whose sole stated legal basis is consent.
Supporting quotations
Send email, direct mail, and social media marketing communications
We collected the following categories of personal data for this purpose:
Name
Hilton Honors number
Corporate travel planner contact information (name, title, company, business phone, email and address)
We rely on the following legal bases to process personal data:
Consent
Qualifications & exceptions
Consent is the only legal basis listed for this purpose.
Legal Rights & Agreement Rules · Company practice
Türkiye: analytics for personalised offers and content — data categories
For the purpose of performing analytics for personalised offers and content, the Türkiye appendix states that Hilton collected name, Hilton Honors number, home address, preferred language, room preference, internet or other electronic network activity information including interaction with Hilton websites, applications or advertisements, IP addresses, session IDs, geolocation information, device information including MAC addresses, and social media information and publicly available online information including through social media platforms. The legal bases for this purpose are set out in the following part of the appendix.
Supporting quotations
Perform analytics for personalized offers and content
We collected the following categories of personal data for this purpose:
Name
Hilton Honors number
Home address
Preferred language
Room preference
Internet or other electronic network activity information, including information regarding a customer's interaction with Hilton websites, applications, or advertisements
IP addresses
Session IDs
Geolocation information
Device information (including MAC addresses)
Social media information; publicly available online information (including through social media platforms)
Qualifications & exceptions
The legal bases for this purpose follow in the next part of the appendix.
The data categories include online activity, device identifiers and location information.
Legal Rights & Agreement Rules · Company practice
Türkiye: legal bases for personalization analytics are legitimate interests and consent
The Türkiye appendix lists demographic data among the data collected for the personalization analytics purpose, and gives the legal bases for that purpose as legitimate interests and consent. The appendix's own note elsewhere states that explicit consent is relied on only where consent is required, and not where one of the other grounds applies.
Supporting quotations
Demographic data
We rely on the following legal bases to process personal data:
Legitimate interests
Consent
Qualifications & exceptions
Two legal bases are listed for this purpose: legitimate interests and consent.
Demographic data is added to the categories for this purpose.
Legal Rights & Agreement Rules · Company practice
Türkiye: analytics to improve business operations — data categories and legal basis
For the purpose of performing analytics to improve business operations, the Türkiye appendix states that Hilton collected name, home address, Hilton Honors number, room preference, internet or other electronic network activity information including interaction with Hilton websites, applications or advertisements, IP addresses, session IDs, booking engine data, whether the person has a Hilton and American Express co-branded credit card, whether their Hilton and Amazon and Hilton and Lyft accounts are linked, and spending amount, and that the legal basis is legitimate interests.
Supporting quotations
Perform analytics to improve business operations
We collected the following categories of personal data for this purpose:
Name
Home address
Hilton Honors number
Room preference
Internet or other electronic network activity information, including information regarding a customer's interaction with Hilton websites, applications, or advertisements
IP addresses
Session IDs
Booking engine
Whether you have a Hilton and American Express Co-branded Credit Card
Whether your Hilton and Amazon accounts are linked
Whether your Hilton and Lyft accounts are linked
Spending amount
We rely on the following legal bases to process personal data:
Legitimate interests
Qualifications & exceptions
Legitimate interests is the only legal basis listed for this purpose.
The categories include spending amount and the linked partner account indicators.
Legal Rights & Agreement Rules · Company practice
Türkiye: eligibility for special or promotional rates — data categories and legal basis
For the purpose of determining guests' eligibility for special or promotional rates, the Türkiye appendix states that Hilton collected name, Hilton Honors number, corporate number and name, and travel agent number and name, and that the legal basis is legitimate interests.
Supporting quotations
Determine guests' eligibility for special or promotional rates
We collected the following categories of personal data for this purpose:
Name
Hilton Honors number
Corporate number and name
Travel agent number and name
We rely on the following legal bases to process personal data:
Legitimate interests
Qualifications & exceptions
Legitimate interests is the only legal basis listed for this purpose.
Legal Rights & Agreement Rules · Company practice
Türkiye: processing payments and strong customer authentication — data categories and legal bases
For the purpose of processing payments, including strong customer authentication where required by law, the Türkiye appendix states that Hilton collected name, home address, payment card information and IP addresses, and that the legal bases are the contract and legal obligations. The purpose itself is qualified by 'when required by law' as to strong customer authentication.
Supporting quotations
Process payments, including strong customer authentication when required by law
We collected the following categories of personal data for this purpose:
Name
Home address
Payment card information
IP addresses
We rely on the following legal bases to process personal data:
Contract
Legal obligations
Qualifications & exceptions
Strong customer authentication is stated to apply only when required by law.
Two legal bases are listed: contract and legal obligations.
Legal Rights & Agreement Rules · Company practice
Türkiye: transactions with partners — data categories and legal basis
For the purpose of processing transactions with partners, the Türkiye appendix states that Hilton collected name, telephone and fax numbers, email address, home address and Hilton Honors number, and that the legal basis is the contract.
Supporting quotations
Process transactions with partners
We collected the following categories of personal data for this purpose:
Name
Telephone and fax numbers
Email address
Home address
Hilton Honors number
We rely on the following legal bases to process personal data:
Contract
Qualifications & exceptions
The contract is the only legal basis listed for this purpose.
Legal Rights & Agreement Rules · Company practice
Türkiye: administering contests and sweepstakes — data categories and legal bases
For the purpose of administering contests and sweepstakes, the Türkiye appendix states that Hilton collected name, email address, home address and Hilton Honors number, and that the legal bases are consent and legitimate interests.
Supporting quotations
Administer contests and sweepstakes
We collected the following categories of personal data for this purpose:
Name
Email address
Home address
Hilton Honors number
We rely on the following legal bases to process personal data:
Consent
Legitimate interests
Qualifications & exceptions
Two legal bases are listed: consent and legitimate interests.
Legal Rights & Agreement Rules · Company practice
Türkiye: optimizing websites and mobile apps — data categories and legal bases
For the purpose of optimizing Hilton's websites and mobile apps, the Türkiye appendix states that Hilton collected name, internet or other electronic network activity information including interaction with Hilton websites, applications or advertisements, and IP addresses, and that the legal bases are consent and legitimate interests.
Supporting quotations
Optimize our websites and mobile apps
We collected the following categories of personal data for this purpose:
Name
Internet or other electronic network activity information, including information regarding a customer's interaction with Hilton websites, applications, or advertisements
IP addresses
We rely on the following legal bases to process personal data:
Consent
Legitimate interests
Qualifications & exceptions
Two legal bases are listed: consent and legitimate interests.
Legal Rights & Agreement Rules · Company practice
Türkiye: detecting and preventing fraud — data categories and legal basis
For the purpose of detecting and preventing fraud, the Türkiye appendix states that Hilton collected name, telephone and fax numbers, email address, home address, payment card information, Hilton Honors number, internet or other electronic network activity information including interaction with Hilton websites, applications or advertisements, IP addresses, session IDs, geolocation information, and device information including MAC addresses, and that the legal basis is legitimate interests.
Supporting quotations
Detect and prevent fraud
We collected the following categories of personal data for this purpose:
Name
Telephone and fax numbers
Email address
Home address
Payment card information
Hilton Honors number
Internet or other electronic network activity information, including information regarding a customer's interaction with Hilton websites, applications, or advertisements
IP addresses
Session IDs
Geolocation information
Device information (including MAC addresses)
We rely on the following legal bases to process personal data:
Legitimate interests
Qualifications & exceptions
Legitimate interests is the only legal basis listed for this purpose.
The categories combine identity, payment, device and online activity data.
Legal Rights & Agreement Rules · Company practice
Türkiye: SMS marketing communications — the data category collected
For the purpose of sending marketing communications via SMS, the Türkiye appendix states that Hilton collected telephone and fax numbers. The legal basis for this purpose is set out in the following part of the appendix.
Supporting quotations
Send marketing communications via SMS
We collected the following categories of personal data for this purpose:
Telephone and fax numbers
Qualifications & exceptions
Only the data category is stated in this part; the legal bases are listed in the next part of the appendix.
Legal Rights & Agreement Rules · Company practice
Türkiye: legal basis for SMS marketing is consent
The Türkiye appendix lists consent as the legal basis for processing the telephone and fax numbers collected for sending marketing communications by SMS. Consent is the only basis listed for that purpose.
Supporting quotations
We rely on the following legal bases to process personal data:
Consent
Qualifications & exceptions
Consent is the only legal basis listed for this purpose.
Legal Rights & Agreement Rules · Company practice
Türkiye: authenticating a mobile account — data categories and legal basis
For the purpose of authenticating a mobile account, the Türkiye appendix states that Hilton collected telephone and fax numbers and email address, and that the legal basis is legitimate interests.
Supporting quotations
Authenticate mobile account
We collected the following categories of personal data for this purpose:
Telephone and fax numbers
Email address
We rely on the following legal bases to process personal data:
Legitimate interests
Qualifications & exceptions
Legitimate interests is the only legal basis listed for this purpose.
Legal Rights & Agreement Rules · Company practice
Türkiye: service-related SMS communications — data category and legal basis
For the purpose of sending service-related SMS communications, the Türkiye appendix states that Hilton collected telephone and fax numbers, and that the legal basis is legitimate interests. The data category is the same as for marketing SMS, but the legal basis differs.
Supporting quotations
Send service-related SMS communications
We collected the following categories of personal data for this purpose:
Telephone and fax numbers
We rely on the following legal bases to process personal data:
Legitimate interests
Qualifications & exceptions
Legitimate interests is the only legal basis listed for this purpose, in contrast to consent for marketing SMS.
Legal Rights & Agreement Rules · Company practice
Türkiye: group bookings, meetings and events — data categories and legal bases
For the purpose of engaging in sales activity for group bookings, meetings and events, the Türkiye appendix states that Hilton collected telephone and fax numbers, email address and home address, and that the legal bases are legitimate interests and consent.
Supporting quotations
Engage in sales activity for group booking, meetings, and events
We collected the following categories of personal data for this purpose:
Telephone and fax numbers
Email address
Home address
We rely on the following legal bases to process personal data:
Legitimate interests
Consent
Qualifications & exceptions
Two legal bases are listed: legitimate interests and consent.
Legal Rights & Agreement Rules · Company practice
Türkiye: email marketing — data category and legal basis
For the purpose of sending marketing communications via email, the Türkiye appendix states that Hilton collected the email address, and that consent is the legal basis relied on.
Supporting quotations
Send marketing communications via email
We collected the following categories of personal data for this purpose:
Email address
We rely on the following legal bases to process personal data:
Consent
Qualifications & exceptions
Consent is the only legal basis listed for this purpose.
Legal Rights & Agreement Rules · Company practice
Türkiye: direct mail marketing — data category and legal basis
For the purpose of sending marketing communications via direct mail, the Türkiye appendix states that Hilton collected the home address, and that consent is the legal basis relied on.
Supporting quotations
Send marketing communications via direct mail
We collected the following categories of personal data for this purpose:
Home address
We rely on the following legal bases to process personal data:
Consent
Qualifications & exceptions
Consent is the only legal basis listed for this purpose.
Legal Rights & Agreement Rules · Company practice
Türkiye: compliance with laws requiring information in some jurisdictions — data categories and legal basis
For the purpose of complying with applicable laws requiring this information in some jurisdictions, the Türkiye appendix states that Hilton collected nationality, date of birth, gender, and images of footage captured by closed circuit television, and that the legal basis is legal obligations. The purpose is qualified by 'some jurisdictions'.
Supporting quotations
Comply with applicable laws requiring this information in some jurisdictions
We collected the following categories of personal data for this purpose:
Nationality
Date of birth
Gender
Images of footage captured by closed circuit television (CCTV)
We rely on the following legal bases to process personal data:
Legal obligations
Qualifications & exceptions
The legal requirement is qualified by 'some jurisdictions'.
Legal obligations is the only legal basis listed for this purpose.
Legal Rights & Agreement Rules · Company practice
Türkiye: books and records for reporting, auditing, tax and income reconciliation
For the purpose of maintaining books and records for business reporting, auditing, tax and income reconciliation, the Türkiye appendix states that Hilton collected payment card information and spending amount, and that the legal basis is legal obligations.
Supporting quotations
Maintain books and records for business reporting, auditing, tax, and income reconciliation
We collected the following categories of personal data for this purpose:
Payment card information
Spending amount
We rely on the following legal bases to process personal data:
Legal obligations
Qualifications & exceptions
Legal obligations is the only legal basis listed for this purpose.
Legal Rights & Agreement Rules · Company practice
Türkiye: logging in to the Hilton Honors account — data category and legal basis
For the purpose of enabling login to the Hilton Honors account, the Türkiye appendix states that Hilton collected the WeChat ID, and that consent is the legal basis relied on.
Supporting quotations
Enable login to Hilton Honors account
We collected the following categories of personal data for this purpose:
WeChat ID
We rely on the following legal bases to process personal data:
Consent
Qualifications & exceptions
Consent is the only legal basis listed for this purpose.
Legal Rights & Agreement Rules · Company practice
Türkiye: superior guest experience — data category and legal basis
For the purpose of providing a superior guest experience, the Türkiye appendix states that Hilton collected the preferred language, and that the legal basis is legitimate interests.
Supporting quotations
Provide superior guest experience
We collected the following categories of personal data for this purpose:
Preferred language
We rely on the following legal bases to process personal data:
Legitimate interests
Qualifications & exceptions
Legitimate interests is the only legal basis listed for this purpose.
Legal Rights & Agreement Rules · Company practice
Türkiye: Hilton Honors communications — data category and legal basis
For the purpose of sending Hilton Honors communications, the Türkiye appendix states that Hilton collected the preferred language, and that consent is the legal basis relied on. The same data category is listed for the superior guest experience purpose, but on a different legal basis.
Supporting quotations
Send Hilton Honors communications
We collected the following categories of personal data for this purpose:
Preferred language
We rely on the following legal bases to process personal data:
Consent
Qualifications & exceptions
Consent is the only legal basis listed for this purpose.
Legal Rights & Agreement Rules · Company practice
Türkiye: marketing communications — preferred language and consent
For the separate purpose of 'Send marketing communications' in the Türkiye appendix, Hilton states that it collected the preferred language and relies on consent. This is listed as its own purpose, distinct from the email, direct mail and SMS marketing purposes, each of which names a different data category.
Supporting quotations
Send marketing communications
We collected the following categories of personal data for this purpose:
Preferred language
We rely on the following legal bases to process personal data:
Consent
Qualifications & exceptions
This is a separate entry from the email, direct mail and SMS marketing purposes.
Consent is the only legal basis listed for this purpose.
Legal Rights & Agreement Rules · Company practice
Türkiye: better serving guests — the widest list of data categories
For the purpose of better serving guests, the Türkiye appendix states that Hilton collected preferred language, room preference, room selection and assignment, arrival time, departure date, MyWay preferences, email and consent preferences such as opt-out or opt-in, descriptions of incidents at a Hilton property or involving a Hilton employee including safety, security, violation of law, policy or contractual obligation, descriptions of complaints including free form textual feedback from Honors members, spa and wellness service or treatment details, and spending amount, and that the legal basis is legitimate interests. This is the broadest data list in the Türkiye purposes.
Supporting quotations
Better serve guests
We collected the following categories of personal data for this purpose:
Preferred language
Room preference
Room selection and assignment
Arrival time
Departure date
MyWay preferences
Email and consent preferences (such as opt-out or opt-in as applicable)
Description of an incident that occurs at a Hilton property or involves a Hilton employee, including incidents related to safety and security, and violation of law, applicable policy, or contractual obligation
Description of a complaint that you make to us, including your free form textual feedback if you are a Hilton Honors member
Spa and wellness service or treatment details (such as date, time, and type of service)
Spending amount
We rely on the following legal bases to process personal data:
Legitimate interests
Qualifications & exceptions
Legitimate interests is the only legal basis listed for this purpose.
The categories include incident and complaint descriptions and spa or treatment details.
The complaint description is included only where the person is a Hilton Honors member.
Legal Rights & Agreement Rules · Company practice
Türkiye: personalizing the guest experience — data categories and legal basis
For the purpose of personalizing the guest experience, the Türkiye appendix states that Hilton collected arrival time and departure date, and that the legal basis is legitimate interests.
Supporting quotations
Personalize guest experience
We collected the following categories of personal data for this purpose:
Arrival time
Departure date
We rely on the following legal bases to process personal data:
Legitimate interests
Qualifications & exceptions
Legitimate interests is the only legal basis listed for this purpose.
Legal Rights & Agreement Rules · Company practice
Türkiye: fulfilling corporate travel reservations — data category and legal basis
For the purpose of fulfilling corporate travel reservations, the Türkiye appendix states that Hilton collected corporate travel planner contact information — name, title, company, business phone, email and address — and that the legal basis is the contract.
Supporting quotations
Fulfill corporate travel reservations
We collected the following categories of personal data for this purpose:
Corporate travel planner contact information (name, title, company, business phone, email and address)
We rely on the following legal bases to process personal data:
Contract
Qualifications & exceptions
The contract is the only legal basis listed for this purpose.
The collected data is that of the corporate travel planner, not of the traveller.
Legal Rights & Agreement Rules · Company practice
Türkiye: contacting media and social influencers — data category and legal basis
For the purpose of contacting the media and social influencers, the Türkiye appendix states that Hilton collected business contact data for members of the media and social media influencers, and that consent is the legal basis relied on.
Supporting quotations
Contact the media and social influencers
We collected the following categories of personal data for this purpose:
Business contact data for members of the media and social media influencers
We rely on the following legal bases to process personal data:
Consent
Qualifications & exceptions
Consent is the only legal basis listed for this purpose.
The data is business contact data about media members and social media influencers.
Legal Rights & Agreement Rules · Company practice
Türkiye: attributing reservations to travel agents — data category and legal basis
For the purpose of attributing reservations to travel agents, the Türkiye appendix states that Hilton collected the travel agent number and name, and that the legal basis is the contract.
Supporting quotations
Attribute reservations to travel agents
We collected the following categories of personal data for this purpose:
Travel agent number and name
We rely on the following legal bases to process personal data:
Contract
Qualifications & exceptions
The contract is the only legal basis listed for this purpose.
Legal Rights & Agreement Rules · Company practice
Türkiye: attributing Points to airline loyalty participants — data category and legal basis
For the purpose of attributing Points to airline loyalty participants, the Türkiye appendix states that Hilton collected the airline partner number and name, and that the legal basis is the contract.
Supporting quotations
Attribute Points to airline loyalty participants
We collected the following categories of personal data for this purpose:
Airline partner number and name
We rely on the following legal bases to process personal data:
Contract
Qualifications & exceptions
The contract is the only legal basis listed for this purpose.
Legal Rights & Agreement Rules · Company practice
Türkiye: enabling parking at properties — data category and legal basis
For the purpose of enabling parking at Hilton properties, the Türkiye appendix states that Hilton collected vehicle information, and that the legal basis is legitimate interests. The same data category is listed for the safety and security purpose.
Supporting quotations
Enable parking at properties
We collected the following categories of personal data for this purpose:
Vehicle information
We rely on the following legal bases to process personal data:
Legitimate interests
Qualifications & exceptions
Legitimate interests is the only legal basis listed for this purpose.
Legal Rights & Agreement Rules · Company practice
Türkiye: enabling safety and security — data category and legal basis
For the purpose of enabling safety and security, the Türkiye appendix states that Hilton collected vehicle information, and that the legal basis is legitimate interests.
Supporting quotations
Enable safety and security
We collected the following categories of personal data for this purpose:
Vehicle information
We rely on the following legal bases to process personal data:
Legitimate interests
Qualifications & exceptions
Legitimate interests is the only legal basis listed for this purpose.
Legal Rights & Agreement Rules · Company practice
Türkiye: protecting people on property — data category and legal basis
For the purpose of protecting people on property, the Türkiye appendix states that Hilton collected images or footage captured by closed circuit television, and that the legal basis is legitimate interests.
Supporting quotations
Protect people on property
We collected the following categories of personal data for this purpose:
Images or footage captured by closed circuit television
We rely on the following legal bases to process personal data:
Legitimate interests
Qualifications & exceptions
Legitimate interests is the only legal basis listed for this purpose.
Legal Rights & Agreement Rules · Company practice
Türkiye: supporting internal and external promotions — data category and legal basis
For the purpose of supporting internal and external promotions, the Türkiye appendix states that Hilton collected promotional images or footage captured by on-property photographers, and that consent is the legal basis relied on. This is the only listed purpose whose data is captured by photographers and whose sole basis is consent.
Supporting quotations
Support internal and external promotions
We collected the following categories of personal data for this purpose:
Promotional images or footage captured by on-property photographers
We rely on the following legal bases to process personal data:
Consent
Qualifications & exceptions
Consent is the only legal basis listed for this purpose.
Legal Rights & Agreement Rules · Company practice
Türkiye: supporting marketing efforts — data categories and legal bases
For the purpose of supporting marketing efforts, the Türkiye appendix states that Hilton collected booking engine data, whether the person has a Hilton and American Express co-branded credit card, whether their Hilton and Amazon and Hilton and Lyft accounts are linked, and spending amount, and that the legal bases are legitimate interests and consent.
Supporting quotations
Support marketing efforts
We collected the following categories of personal data for this purpose:
Booking engine
Whether you have a Hilton and American Express Co-Branded Credit Card
Whether your Hilton and Amazon accounts are linked
Whether your Hilton and Lyft accounts are linked
Spending amount
We rely on the following legal bases to process personal data:
Legitimate interests
Consent
Qualifications & exceptions
Two legal bases are listed: legitimate interests and consent.
Legal Rights & Agreement Rules · Company practice
Türkiye: sharing data with personalized ad networks — data categories and legal bases
For the purpose of sharing data with personalized ad networks, the Türkiye appendix states that Hilton collected internet or other electronic network activity information including interaction with Hilton websites, applications or advertisements, IP addresses, session IDs and device information including MAC address, and that the legal bases are legitimate interests and consent.
Supporting quotations
Share data with personalized ad networks
We collected the following categories of personal data for this purpose:
Internet or other electronic network activity information, including information regarding a customer's interaction with Hilton websites, applications, or advertisements
IP addresses
Session IDs
Device information (including MAC address)
We rely on the following legal bases to process personal data:
Legitimate interests
Consent
Qualifications & exceptions
Two legal bases are listed: legitimate interests and consent.
Legal Rights & Agreement Rules · Company practice
Türkiye: solving website issues — data categories and legal basis
For the purpose of solving website issues, the Türkiye appendix states that Hilton collected IP addresses, customer ratings and survey responses, and free form textual feedback, and that the legal basis is legitimate interests.
Supporting quotations
Solve website issues
We collected the following categories of personal data for this purpose:
IP addresses
Customer ratings and survey responses
Free form textual feedback
We rely on the following legal bases to process personal data:
Legitimate interests
Qualifications & exceptions
Legitimate interests is the only legal basis listed for this purpose.
Legal Rights & Agreement Rules · Company practice
Türkiye: showing targeted advertisements on media — data categories and legal bases
For the purpose of showing targeted advertisements on media, the Türkiye appendix states that Hilton collected booking engine data, whether the person has a Hilton and American Express co-branded credit card, and whether their Hilton and Amazon and Hilton and Lyft accounts are linked, and that the legal bases are legitimate interests and consent.
Supporting quotations
Show targeted advertisements on media
We collected the following categories of personal data for this purpose:
Booking engine
Whether you have a Hilton and American Express Co-Branded Credit Card
Whether your Hilton and Amazon accounts are linked
Whether your Hilton and Lyft accounts are linked
We rely on the following legal bases to process personal data:
Legitimate interests
Consent
Qualifications & exceptions
Two legal bases are listed: legitimate interests and consent.
Legal Rights & Agreement Rules · Company practice
Türkiye: evaluating streaming service use — data category and legal basis
For the purpose of evaluating streaming service use, the Türkiye appendix states that Hilton collected streaming service usages, including the service used, hours of use, launch method and logout method, and that the legal basis is legitimate interests.
Supporting quotations
Evaluate streaming services use
We collected the following categories of personal data for this purpose:
Streaming service usages (including service used, hours of use, launch method, and logout method)
We rely on the following legal bases to process personal data:
Legitimate interests
Qualifications & exceptions
Legitimate interests is the only legal basis listed for this purpose.
Legal Rights & Agreement Rules · Company practice
Türkiye: co-branded card benefits — data category and legal basis
For the purpose of providing co-branded card benefits, the Türkiye appendix states that Hilton collected whether the person has a Hilton and American Express co-branded credit card, and that the legal basis is the contract. The data collected is the fact of holding the card, not the card details.
Supporting quotations
Provide co-branded card benefits
We collected the following categories of personal data for this purpose:
Whether you have a Hilton and American Express Co-Branded Credit Card
We rely on the following legal bases to process personal data:
Contract
Qualifications & exceptions
The contract is the only legal basis listed for this purpose.
Legal Rights & Agreement Rules · Company practice
Türkiye: Amazon's Shop with Points — data category and legal basis
For the purpose of facilitating Amazon's Shop with Points, the Türkiye appendix states that Hilton collected whether the person's Hilton and Amazon accounts are linked, and that the legal basis is the contract.
Supporting quotations
Facilitate Amazon's Shop with Points
We collected the following categories of personal data for this purpose:
Whether your Hilton and Amazon accounts are linked
We rely on the following legal bases to process personal data:
Contract
Qualifications & exceptions
The contract is the only legal basis listed for this purpose.
Legal Rights & Agreement Rules · Company practice
Türkiye: access to hotel room and facilities — data category and legal basis
For the purpose of enabling access to the hotel room and facilities, the Türkiye appendix states that Hilton collected geolocation information, and that the legal basis is legitimate interests.
Supporting quotations
Enable access to hotel room and facilities
We collected the following categories of personal data for this purpose:
Geolocation information
We rely on the following legal bases to process personal data:
Legitimate interests
Qualifications & exceptions
Legitimate interests is the only legal basis listed for this purpose.
Legal Rights & Agreement Rules · Company practice
Türkiye: Digital Key sharing — data category and legal basis
For the purpose of fulfilling Digital Key sharing, the Türkiye appendix states that Hilton collected geolocation information, and that the legal basis is consent. The same data category is listed for enabling access to hotel room and facilities, but on the basis of legitimate interests.
Supporting quotations
Fulfill Digital Key sharing
We collected the following categories of personal data for this purpose:
Geolocation information
We rely on the following legal bases to process personal data:
Consent
Qualifications & exceptions
Consent is the only legal basis listed for this purpose.
Legal Rights & Agreement Rules · Company practice
Türkiye: responding to service concerns — the data category collected
For the purpose of responding to service concerns, the Türkiye appendix states that Hilton collected social media information and publicly available online information, including through social media platforms. The legal bases for this purpose are set out in the following part of the appendix.
Supporting quotations
Respond to service concerns
We collected the following categories of personal data for this purpose:
Social media information; publicly available online information (including through social media platforms)
Qualifications & exceptions
Only the data category is stated in this part; the legal bases are listed in the next part of the appendix.
Legal Rights & Agreement Rules · Company practice
Türkiye: legal bases for responding to service concerns are legitimate interests and consent
The Türkiye appendix gives two legal bases for processing the social media information and publicly available online information collected to respond to service concerns: legitimate interests and consent.
Supporting quotations
We rely on the following legal bases to process personal data:
Legitimate interests
Consent
Qualifications & exceptions
Two legal bases are listed: legitimate interests and consent.
Legal Rights & Agreement Rules · Company practice
Türkiye: providing a personalized experience — data category and legal basis
For the purpose of providing a personalized experience, the Türkiye appendix states that Hilton collected social media information and publicly available online information, including through social media platforms, and that the legal basis is legitimate interests. The same data category is listed for responding to service concerns, where the bases are legitimate interests and consent.
Supporting quotations
Provide personalized experience
We collected the following categories of personal data for this purpose:
Social media information; publicly available online information (including through social media platforms)
We rely on the following legal bases to process personal data:
Legitimate interests
Qualifications & exceptions
Legitimate interests is the only legal basis listed for this purpose.
Linking & Identification · Company practice
Türkiye: linking with customer information on file — data category and legal basis
For the purpose of linking with customer information Hilton already has on file, the Türkiye appendix states that it collected demographics data, and that consent is the legal basis relied on. Linking is the purpose; the data used for it is third-party demographics data.
Supporting quotations
Link with customer information on file
We collected the following categories of personal data for this purpose:
Demographics data
We rely on the following legal bases to process personal data:
Consent
Qualifications & exceptions
Consent is the only legal basis listed for this purpose.
Legal Rights & Agreement Rules · Company practice
Türkiye: sending requested communications — data category and legal basis
For the purpose of sending requested communications, the Türkiye appendix states that Hilton collected MyWay preferences, and that consent is the legal basis relied on. The data is the member's recorded communication preferences rather than contact details.
Supporting quotations
Send requested communications
We collected the following categories of personal data for this purpose:
MyWay preferences
We rely on the following legal bases to process personal data:
Consent
Qualifications & exceptions
Consent is the only legal basis listed for this purpose.
Legal Rights & Agreement Rules · Company practice
Türkiye: responding to safety and security concerns — data categories and legal basis
For the purpose of responding to safety and security concerns, the Türkiye appendix states that Hilton collected descriptions of incidents at a Hilton property or involving a Hilton employee, including safety and security incidents and violations of law, applicable policy or contractual obligation, descriptions of complaints including free form textual feedback from Hilton Honors members, and spa and wellness service or treatment details, and that the legal basis is legitimate interests. The same three categories are listed for the separate compliance purpose, on the basis of legal obligations.
Supporting quotations
Respond to safety and security concerns
We collected the following categories of personal data for this purpose:
Description of an incident that occurs at a Hilton property or involves a Hilton employee, including incidents related to safety and security, and violation of law, applicable policy, or contractual obligation
Description of a complaint that you make to us, including your free form textual feedback if you are a Hilton Honors member
Spa and wellness service or treatment details (such as date, time, and type of service)
We rely on the following legal bases to process personal data:
Legitimate interests
Qualifications & exceptions
Legitimate interests is the only legal basis listed for this purpose.
The complaint description is included only where the person is a Hilton Honors member.
Legal Rights & Agreement Rules · Company practice
Türkiye: complying with legal or contractual obligations — data categories and legal basis
For the purpose of complying with legal or contractual obligations, the Türkiye appendix states that Hilton collected descriptions of incidents at a Hilton property or involving a Hilton employee, descriptions of complaints including free form textual feedback from Hilton Honors members, and spa and wellness service or treatment details, and that the legal basis is legal obligations. The same three categories are listed for the safety and security purpose, on the basis of legitimate interests.
Supporting quotations
Comply with legal or contractual obligations
We collected the following categories of personal data for this purpose:
Description of an incident that occurs at a Hilton property or involves a Hilton employee, including incidents related to safety and security, and violation of law, applicable policy, or contractual obligation
Description of a complaint that you make to us, including your free form textual feedback if you are a Hilton Honors member
Spa and wellness service or treatment details (such as date, time, and type of service)
We rely on the following legal bases to process personal data:
Legal obligations
Qualifications & exceptions
Legal obligations is the only legal basis listed for this purpose.
The complaint description is included only where the person is a Hilton Honors member.
Legal Rights & Agreement Rules · User right or choice
Türkiye: rights under Article 11, and the thirty-day response with a possible fee
The Türkiye appendix states that the person has rights under Article 11 of the Data Protection Law and may exercise them by contacting the Data Protection Office by email or post. It says requests found in the application will be resolved as soon as possible according to the nature of the request and within thirty days at the latest and free of charge, but that if a request incurs additional cost to Hilton, the person may be charged over the tariff fee determined by the Turkish Personal Data Protection Board. The appendix cites Article 11 without reproducing the law.
Supporting quotations
Your rights. You have the rights under Article 11 of the Data Protection Law and may exercise your rights by contacting us at: DataProtectionOffice@hilton.com
The requests found in your application will be resolved as soon as possible according to the nature of your request and within thirty days at the latest free of charge.
if your request incurs additional cost to our company, then you may be charged over the tariff fee determined by the Turkish Personal Data Protection Board.
Qualifications & exceptions
The response is due within thirty days at the latest and free of charge, unless the request incurs additional cost.
The possible charge is at the tariff fee set by the Turkish Personal Data Protection Board.
The article number is cited; the appendix does not set out the law's terms.
Legal Rights & Agreement Rules · Restriction or exception
Türkiye: two sentences of the main Statement do not apply in Türkiye
The Türkiye appendix lists two passages of the Global Privacy Statement that do not apply to individuals in Türkiye. The first is the sentence in the second paragraph of the Introduction, under which a person acknowledges that Hilton will collect and use personal information as described in the Statement by using its products or services or agreeing to the Statement. The second is the sentence in the International Personal Data Transfers section, under which a person acknowledges that Hilton may share personal information among Portfolio members, service providers and other third parties which may be located outside their own country. In Türkiye, the cross-border position is instead handled by the separate consent practice described later in the appendix.
Supporting quotations
Amendments. The following sections of the Global Privacy Statement do not apply to individuals in Türkiye:
The following sentence at the second paragraph: By using any of our products or services and/or by agreeing to this Statement, e.g., in the context of registering for any of our products or services, you understand and acknowledge that we will collect and use personal information as described in this Statement.
The following sentence in the International Personal Data Transfers section: To provide this service, you acknowledge that we may share your personal information among members of the Hilton Portfolio of Brands, our service providers, and other third parties, which may be located in countries outside of your own.
Qualifications & exceptions
The exclusions are limited to the two quoted sentences.
The International Data Transfers acknowledgement sentence is replaced by the appendix's own consent practice.
Legal Rights & Agreement Rules · Context
Türkiye: the Turkish version prevails over the English version
The Türkiye appendix states that the Statement is available in English and Turkish, and that if there is any inconsistency or different interpretation between the two versions, the Turkish text shall prevail. The analysed source is the English text, so the English wording may differ from the governing Turkish wording.
Supporting quotations
Language. This Statement is available in English and Turkish. If there is any inconsistency or different interpretation between the English and Turkish versions, the Turkish text shall prevail.
Qualifications & exceptions
The Turkish text prevails over the English text in case of inconsistency or different interpretation.
The source analysed here is the English version.
Legal Rights & Agreement Rules · Company practice
Türkiye: consent for cross-border transfers, described as a temporary practice
The Türkiye appendix states that Hilton is required to transfer personal data to affiliates outside Türkiye, including Hilton Domestic Operating Company Inc. and its in-country suppliers, all resident in the United States, to complete reservations, process Hilton Honors memberships and conduct promotion activities through a website whose servers are located abroad. It says that without consent Hilton cannot provide its services through that website, and that it therefore asks for consent when the site is accessed for the cross-border transfer of data. It adds that this consent practice is only temporary, that Hilton is working on an undertaking letter, described as one of the alternative legal mechanisms for cross-border transfers, and that the consent practice will end once the undertaking letter is prepared and approved by the Personal Data Protection Authority.
Supporting quotations
International Data Transfers. Hilton is required to transfer your personal data to its affiliates outside of Türkiye, which includes Hilton Domestic Operating Company Inc., all resident in the United States, as well as their in-country suppliers, in order to complete reservations, process Hilton Honors memberships and conduct promotion activities through its website, whose servers are located abroad.
Without your consent, Hilton is unable to provide you with its services through this website. Therefore, we ask for your consent when you access this website for the cross-border transfer of your data.
This consent practice is only temporary, and Hilton is working on effecting an undertaking letter, which is one of the alternative legal mechanisms for cross-border data transfers.
Accordingly, the consent practice will be terminated once the undertaking letter is prepared and approved by the Personal Data Protection Authority.
Qualifications & exceptions
The consent request is tied to accessing the website, and the service cannot be provided through it without consent.
The consent practice is stated to be temporary and to end when the undertaking letter is approved.
The transfer destinations are named as affiliates outside Türkiye, including Hilton Domestic Operating Company Inc.
Legal Rights & Agreement Rules · Context
China appendix: who it covers, and that it prevails over the main body on conflict
The China appendix says it applies to individuals who reside in the People's Republic of China — for the purposes of the Statement excluding Hong Kong SAR, Macau SAR and Taiwan, referred to as China — and to citizens of the People's Republic of China, and that it introduces how Hilton collects, uses, discloses and otherwise processes their personal information, including sensitive personal information where applicable. It states that the appendix does not replace the main body but supplements it and should be read with the main body and Appendix A as applicable, and that in the event of any conflict or inconsistency the China appendix prevails.
Supporting quotations
Appendix A-6: China Residents
1. Introduction
For individuals who reside in the People's Republic of China (for the purposes of this Privacy Statement, excluding Hong Kong Special Administrative Region, Macau Special Administrative Region and Taiwan) ("China") or citizens of the People's Republic of China
in this Appendix, we provide you with an introduction to how Hilton collects, uses, discloses, and otherwise processes your personal information (including sensitive personal information, where applicable) that we receive or collect from you.
This Appendix does not replace the main body of this Statement, but supplements the main body of this Statement, and should be read together with the main body and Appendix A, as applicable.
In the event of any conflict or inconsistency between this Appendix and the main body of this statement, this Appendix shall prevail.
Qualifications & exceptions
Hong Kong SAR, Macau SAR and Taiwan are excluded from the definition of China used in the appendix.
The appendix prevails over the main body in case of conflict or inconsistency.
It supplements rather than replaces the main body.
Legal Rights & Agreement Rules · Context
China: the meaning of personal information and sensitive personal information, and the strict-necessity limit
The China appendix states that 'Personal Information' and 'Sensitive personal information' have the same meaning as defined in the Personal Information Protection Law of the People's Republic of China, as revised from time to time, and that personal information can be recorded electronically or otherwise and can identify the identity or reflect the activity of a specific natural person alone or in combination with other information. It says the sensitive personal information involved in the Statement may include passport or ID card information, payment card information, spending amount, accommodation information such as arrival and departure time, interaction with Hilton websites, and precise positioning information, and that Hilton processes it only where strictly necessary for the relevant purposes identified in the collection section of the main body, adhering to the safeguards mandated by applicable laws and regulations. It warns that such processing may have impacts including potential harm to reputation, property or personal safety in the event of a data breach, and records the person's agreement that the sensitive personal information will be processed in accordance with the purposes and methods set out in the Statement.
Supporting quotations
“Personal Information” shall have the same meaning as defined in the Personal Information Protection Law of the People's Republic of China (as revised from time to time).
The sensitive personal information involved in this Statement may include passport or ID card information, payment card information, spending amount, accommodation information (such as arrival and departure time), interaction with Hilton websites, and precise positioning information.
We only process your sensitive personal information where such processing is strictly necessary for the relevant purposes identified in the Personal Information We Collect
such processing may result in various impacts, including potential harm to your reputation, property, or personal safety in the event of a data breach.
You agree that the sensitive personal information will be processed in accordance with the purposes and methods set forth in this Statement.
Qualifications & exceptions
The definitions are those of the Chinese Personal Information Protection Law, which the appendix does not reproduce.
Sensitive personal information is processed only where strictly necessary for the relevant purposes.
The data-breach impact is stated as a possible outcome, including harm to reputation, property or personal safety.
The person's agreement is recorded for processing the sensitive personal information on the Statement's purposes and methods.
Data Access & Collection · Context
China: the main body's collection section is incorporated, plus additional categories shared with third parties
The China appendix says that for the types of personal information collected, and for how Hilton collects and uses personal information, the purposes of use and the sharing or disclosure of personal information, readers should refer to the Personal Information We Collect section of the main body. It then adds that in addition to the information given in that section, Hilton may collect, process or share the personal information listed in the appendix with third parties for the purposes set out there. The list that follows is the China-specific addition to the main body's disclosure list.
The types of personal information that we collect from you (including sensitive personal information)
How we collect and use your personal information, the purposes for which we use it, and how we share or disclose your personal information.
In addition to the information provided in the Personal Information We Collect section of this Statement, we may collect, process, or share the following personal information with third parties for the purposes set out below:
Qualifications & exceptions
The main body's collection section is the stated source for the types of information and the purposes of use.
The China list is stated as an addition to, not a replacement for, the main body.
Data Access & Collection · Company practice
China: gender — source, purpose and sharing
In the China appendix's list, gender is obtained directly from consumers themselves, collected for the business or commercial purpose of providing customer service, and shared with government agencies pursuant to legal requirements in some countries. The list gives no sale status for this category.
Supporting quotations
Gender
We have obtained this personal information from the following sources
Directly from consumers themselves
We collected this personal information for the following business or commercial purposes
Provide customer service
We have shared this personal information with the following categories of third parties
Government agencies pursuant to legal requirements in some countries
Qualifications & exceptions
The government-agency sharing is qualified by legal requirements in some countries.
Data Access & Collection · Company practice
China: telephone — sources of collection
In the China appendix's list, the telephone number is obtained from three sources: directly from consumers themselves, from third parties such as travel booking platforms and credit card providers, and from demographics companies. The purposes and sharing for this category follow in the next part of the appendix.
Supporting quotations
Telephone
We have obtained this personal information from the following sources
Directly from consumers themselves
From third parties such as travel booking platforms and credit card providers
From demographics companies
Qualifications & exceptions
Only the sources of this category are stated in this part; the purposes and sharing follow in the next part.
Data Access & Collection · Company practice
China: telephone — purposes and third-party sharing
In the China appendix's list, the telephone number is collected for the business or commercial purposes of executing marketing communications and performing analytics to provide guests with personalized offers and content, and is shared with service providers who perform tasks on behalf of Hilton, which may include those who send marketing communications on its behalf, with Hilton's Third-Party Partner, with employers pursuant to corporate agreements, employee consent and as permitted by law, with the third-party travel booking platform or travel agent through which the guest made a reservation, with third-party advertisers for optimization and personalization on their platforms, with Hilton's Third-Party Operator and with Hilton Principal.
Supporting quotations
We collected this personal information for the following business or commercial purposes
Executing marketing communications
Perform analytics to provide guests with personalized offers and content
We have shared this personal information with the following categories of third parties
Service providers who perform tasks on behalf of Hilton, which may include those who send marketing communications on our behalf
Hilton's Third-Party Partner
Employers pursuant to corporate agreements, employee consent, and as permitted by law
The third-party travel booking platform or travel agent through which a guest made a reservation
Third-party advertisers, for optimization and personalization on their platforms
Hilton's Third-Party Operator
Hilton Principal
Qualifications & exceptions
Employer sharing is conditional on corporate agreements, employee consent and the law.
The third-party advertisers entry is qualified to optimization and personalization on their own platforms.
Data Access & Collection · Company practice
China: arrival time — source and purposes
In the China appendix's list, the arrival time is obtained directly from consumers themselves, and collected for the business or commercial purposes of better serving guests, fulfilling reservations, personalizing the guest experience and providing customer service and support. The sharing for this category is set out in the next part of the appendix.
Supporting quotations
Arrival Time
We have obtained this personal information from the following sources
Directly from consumers themselves
We collected this personal information for the following business or commercial purposes
Better serve our guests
Fulfill reservations
Personalize guest experience
Provide customer service and support
Qualifications & exceptions
Only the source and purposes are stated in this part; the sharing follows in the next part.
Sharing & Disclosure · Company practice
China: arrival time — sharing with service providers
The China appendix's arrival time entry states that the information was shared with service providers who perform tasks on behalf of Hilton. The sources and purposes for arrival time are set out in the preceding part of the appendix.
Supporting quotations
We have shared this personal information with the following categories of third parties
Service providers who perform tasks on behalf of Hilton
Data Access & Collection · Company practice
China: departure date — source, purposes and sharing
In the China appendix's list, the departure date is obtained directly from consumers themselves, collected for the business or commercial purposes of better serving guests, fulfilling reservations and personalizing the guest experience, and shared with service providers who perform tasks on behalf of Hilton.
Supporting quotations
Departure Date
We have obtained this personal information from the following sources
Directly from consumers themselves
We collected this personal information for the following business or commercial purposes
Better serve our guests
Fulfill reservations
Personalize guest experience
We have shared this personal information with the following categories of third parties
Service providers who perform tasks on behalf of Hilton
Data Access & Collection · Company practice
China: spending amount — source, purposes and sharing
In the China appendix's list, the spending amount is obtained directly from consumers themselves, collected for the business or commercial purposes of better serving guests, performing analytics to improve business operations, supporting marketing efforts, and fulfilling obligations for business reporting, auditing, tax and income reconciliation, and shared with service providers who perform tasks on behalf of Hilton.
Supporting quotations
Spending Amount
We have obtained this personal information from the following sources
Directly from consumers themselves
We collected this personal information for the following business or commercial purposes
Better serve our guests
Perform analytics to improve business operations
Support marketing efforts
Fulfill obligations for business reporting, auditing, tax, and income reconciliation
We have shared this personal information with the following categories of third parties
Service providers who perform tasks on behalf of Hilton
Data Access & Collection · Company practice
China: WeChat Union ID — source, purpose and sharing
In the China appendix's list, the WeChat Union ID is obtained directly from consumers themselves, collected for the business or commercial purpose of performing analytics to provide guests with personalized offers and content, and shared with service providers who perform tasks on behalf of Hilton and with Hilton's Third-Party Partners.
Supporting quotations
WeChat Union ID
We have obtained this personal information from the following sources
Directly from consumers themselves
We collected this personal information for the following business or commercial purposes
Perform analytics to provide guests with personalized offers and content
We have shared this personal information with the following categories of third parties
Service providers who perform tasks on behalf of Hilton
Hilton’s Third-Party Partners
Data Access & Collection · Company practice
China: WeChat Open ID — source, purpose and sharing
In the China appendix's list, the WeChat Open ID is obtained directly from consumers themselves, collected for the business or commercial purpose of performing analytics to provide guests with personalized offers and content, and shared with service providers who perform tasks on behalf of Hilton. Unlike the WeChat Union ID category, no Third-Party Partner is named as a recipient here.
Supporting quotations
WeChat Open ID
We have obtained this personal information from the following sources
Directly from consumers themselves
We collected this personal information for the following business or commercial purposes
Perform analytics to provide guests with personalized offers and content
We have shared this personal information with the following categories of third parties
Service providers who perform tasks on behalf of Hilton
Linking & Identification · Company practice
China: linking Hilton Honors and partner accounts for targeted campaigns and promotions
The China appendix lists a category covering the binding relationship between Hilton Honors accounts and partners' accounts, including the Hilton Honors account number and the partners' account number. The source of that information is stated as both Hilton's and the partners' platforms; the purpose is linking the accounts to participate in targeted campaigns and promotions; and the information is shared with Hilton's Third-Party Partners. This is the only category in the China list whose stated purpose is account linking for marketing campaigns.
Supporting quotations
Binding relationship between Hilton Honors accounts and partners' accounts, including Hilton Honors account number and partners’ account number
We have obtained this personal information from the following sources
From both Hilton and partners’ platforms
We collected this personal information for the following business or commercial purposes
Linking the accounts to participate in targeted campaigns and promotions
We have shared this personal information with the following categories of third parties
Hilton’s Third-Party Partners
Qualifications & exceptions
The data comes from both Hilton's and the partners' platforms.
The stated purpose is limited to participation in targeted campaigns and promotions.
Legal Rights & Agreement Rules · Restriction or exception
China: no knowing collection or disclosure from children under 14
The China appendix states that Hilton will not knowingly collect or disclose personal information from minors under the age of 14, and that when it collects personal information from an individual under the age of 14 it needs to obtain consent from their parent or guardian and will process that information in accordance with the safeguards set out in applicable laws and regulations. This is a China-specific threshold; the main body of the Statement uses the age of majority in the person's own jurisdiction instead.
Supporting quotations
Hilton will not knowingly collect or disclose personal information from minors under the age of 14.
When we collect personal information from an individual under the age of 14, we need to obtain consent from their parent or guardian, and we will process such information in accordance with the safeguards set out in applicable laws and regulations.
Qualifications & exceptions
The threshold is 14 and applies to knowing collection or disclosure.
Parent or guardian consent is required, and the safeguards of applicable laws and regulations apply.
Legal Rights & Agreement Rules · Company practice
China: consent for processing, further consent for other purposes, and the consequence of refusal
The China appendix states that Hilton will use personal information with the person's consent or as otherwise required or permitted by applicable law, giving as examples processing necessary for concluding or performing a contract and processing necessary to perform legal obligations. It says that if it wants to use the information for other purposes it will obtain further consent, unless the further use without new consent is required or permitted by applicable law, and that where it relies on consent and the person refuses, it might not be able to provide all of its services.
Supporting quotations
We will use your personal information with your consent or as otherwise required or permitted by applicable law (e.g., where the processing is necessary for concluding or performing a contract with you, where the processing is necessary to perform legal obligations, etc.).
If we want to use your personal information for other purposes, we will obtain your further consent unless the further use without your new consent is required or permitted by applicable law.
Where we rely on your consent to process your personal information and you refuse to give consent, we might not be able to provide all of our services.
Qualifications & exceptions
Further consent is required for other purposes unless that use is required or permitted by applicable law.
Refusal of consent may mean Hilton cannot provide all of its services.
Sharing & Disclosure · Company practice
China: who personal information may be shared with, with express consent where required
The China appendix says that with the person's express consent where required, Hilton may share their personal information for the purposes described in the Statement with members of the Hilton worldwide brand portfolio, its service providers and other third parties as follows: Hilton Worldwide Holdings Inc. and its subsidiaries and members of the Hilton brand portfolio, including franchised and managed hotels; service providers providing services on Hilton's behalf; payment card providers and processors; employers specified in the company agreements; and advertising networks and analytics providers for Hilton's website and mobile applications. The sharing is framed as conditioned on express consent where required.
Supporting quotations
3. Entrusted Processing, Sharing, Transfer, and Disclosure of Personal Information
With your express consent, where required, we may share your personal information for the purposes described in this Statement with members of the Hilton worldwide brand portfolio, our service providers, and other third parties as follows:
Hilton Worldwide Holdings Inc. and its subsidiaries, and members of the Hilton brand portfolio, including franchised and managed hotels,
Service providers providing services on Hilton’s behalf,
Payment card providers and processors
Employers specified in the company agreements,
Advertising networks and analytics providers for Hilton’s website and mobile applications.
Qualifications & exceptions
The express consent requirement applies 'where required'.
The listed recipients are categories, including franchised and managed hotels.
Sharing & Disclosure · Company practice
China: Portfolio brands' own processing is governed by the Statement, and third-party controllers apply their own
The China appendix states that the processing of personal information by members of the Hilton Portfolio of Brands, including purposes and means of processing and the categories of personal information processed, is governed by the Statement, and points to the Data Protection Office for the contact information of other entities that may receive the personal data. It adds that some of the third parties listed may also process the personal information for their own purposes as data controllers, in which case their own privacy policies apply, including as to purposes, means of processing and categories processed.
Supporting quotations
The processing of your personal information by members of the Hilton Portfolio of Brands, including purposes and means of processing and categories of personal information processed, is governed by this Statement.
Please refer to the Data Protection Office at dataprotectionoffice@hilton.com
Some of the third parties listed above may also process your personal information for their own purposes as data controllers, in which case their own privacy policies will apply, including as to the purposes and means of processing and categories of personal information processed.
Qualifications & exceptions
Where a listed third party acts as a controller for its own purposes, that party's own privacy policies apply instead.
The contact route for the other recipients is the Data Protection Office.
Use & Processing · Context
China: section 3.1 on entrusted processing of personal information
This is the heading for section 3.1 of the China appendix, which addresses entrusted processing of personal information. Its content follows in the next part of the appendix.
Supporting quotations
3.1 Entrusted Processing of Your Personal Information
Qualifications & exceptions
The section heading introduces material set out in the following part of the appendix.
Use & Processing · Company practice
China: entrusted processing by third-party service providers
The China appendix says that to achieve the purposes described in the Statement, Hilton may entrust third-party service providers to assist in providing relevant operational and service support, and that during such entrusted processing personal information may be processed to enable the functions of its products and services. The listed providers are SMS and MMS service providers; marketing, research, advertisement and data analytics service providers; website and system server hosting service providers; software and system technical service providers; and invoice service providers.
Supporting quotations
To achieve the purposes described in this Statement, we may entrust third-party service providers to assist us in providing relevant operational and service support.
your personal information may be processed to enable the functions of our products and/or services, including but not limited to the following:
SMS and MMS service providers
Marketing, research, advertisement, and data analytics service providers
Website and system server hosting service providers
Software and system technical service providers
Invoice service providers
Qualifications & exceptions
The list is given as 'including but not limited to', so it is illustrative rather than exhaustive.
The entrusted processing is stated to serve the purposes described in the Statement.
Sharing & Disclosure · Company practice
China: sharing with third parties for media campaigns, with their own privacy policies
The China appendix says that to optimize media campaigns Hilton may share personal information with partners and other third parties, and that it then lists the third parties with whom it currently cooperates, their names, the types of personal information collected and the purposes of collection and use. It directs readers to those third parties' own privacy policies for details of their collection and processing.
Supporting quotations
3.2 Sharing Your Personal Information with Third-Parties
To optimize media campaigns, we may share your personal information with partners and other third parties.
For details regarding the collection and processing of your personal information by the following third parties, please refer to the privacy policies of such third parties.
Qualifications & exceptions
The stated purpose of the sharing is to optimize media campaigns.
The list covers third parties with whom Hilton currently cooperates.
The third parties' own privacy policies govern their collection and processing.
Sharing & Disclosure · Company practice
China: Shenzhen Tencent — media campaign sharing of hashed phone numbers and WeChat Union ID
The China appendix names Shenzhen Tencent Computer Systems Company Limited as a third party with which Hilton cooperates. The purpose of the personal information processing is to optimize media campaigns, and the method is sharing personal information with third-party advertising platforms through backend API integrations — such as hashed or encrypted mobile phone numbers and the WeChat Union ID — to recommend or display content, products or services that may be relevant to users based on their personal information and preferences. The types shared are the hashed mobile phone number and the WeChat Union ID, and the contact given for the third party is ads_service@tencent.com.
Supporting quotations
Shenzhen Tencent Computer Systems Company Limited
Purpose of personal information processing
Optimize media campaigns
Method of personal information processing
Share personal information with third-party advertising platforms through backend API integrations (such as hashed/encrypted mobile phone numbers, WeChat Union ID) to recommend or display content, products, or services that may be relevant to users based on their personal information and preferences.
Types of personal information shared with third party
Hashed mobile phone number
WeChat Union ID
Contact of third party
ads_service@tencent.com
Qualifications & exceptions
The phone number is described as hashed or encrypted when shared.
The stated purpose of the sharing is to recommend or display content, products or services relevant to the user.
Sharing & Disclosure · Company practice
China: co-branded membership programmes and the sharing of the Honors number
The China appendix states that Hilton may also collaborate with certain third-party partners to offer co-branded membership programmes, and that where the person chooses to take part, Hilton and the relevant partner may independently process their personal information. It says Hilton may share the person's Hilton Honors number with the relevant partner to link the membership accounts and to provide, operate and administer the applicable co-branded membership programme and related benefits.
Supporting quotations
We may also collaborate with certain third-party partners to offer co-branded membership programs.
Where you choose to participate in such programs, we and the relevant partner may independently process your personal information.
We may share your Hilton Honors number with the relevant partner to link your membership accounts and to provide, operate, and administer the applicable co-branded membership program and related benefits.
Qualifications & exceptions
Participation is voluntary: the sharing happens where the person chooses to participate.
The partner may process the person's information independently, as its own controller.
What is shared is the Hilton Honors number.
Data Access & Collection · Company practice
China: third-party SDKs embedded in the applications, with their own privacy policies
The China appendix says that to provide and optimize its services, third-party SDKs are embedded in Hilton's applications, including WeChat Mini Programs, and that it lists the names of the third-party SDKs it currently embeds, the types of personal information collected and the purpose of collection and use. It directs anyone with questions about collection through the SDKs to the third parties' own privacy policies.
Supporting quotations
3.3 Third-Party SDKs:
To provide and optimize our services, third-party SDKs are embedded in our applications (including WeChat Mini Programs).
The following lists the names of the third-party SDKs we currently embed, the types of personal information collected, and the purpose of collection and use.
please refer to the privacy policies of such third parties.
Qualifications & exceptions
The list covers SDKs Hilton currently embeds.
The SDKs are embedded in the applications, including WeChat Mini Programs.
Collection through the SDKs is governed by the third parties' own privacy policies.
Data Access & Collection · Company practice
Third-party SDK: Alipay App Payment
The China appendix lists the Alipay App Payment SDK, provided by Alipay (China) Network Technology Co., Ltd., with the purpose of payment, embedded in the iOS and Android applications. The types of personal information collected by the SDK are listed as common device information: IMEI/IMSI, SIM card serial number or MAC address, android_id for Android devices only, and network information. The appendix links to the SDK's own privacy policy.
Supporting quotations
Alipay "App Payment" SDK
Provider of the SDK
Alipay (China) Network Technology Co., Ltd.
Purposes of the SDK
Payment
Application where the SDK is embedded
iOS, Android
Types of personal information collected by the SDK
Common device information (IMEI/IMSI, SIM card serial number/MAC address, android_id (only for Android devices), network information
The android_id element is collected only for Android devices.
The SDK is embedded in the iOS and Android applications.
Data Access & Collection · Company practice
Third-party SDK: WeChat Pay
The China appendix lists the WeChat Pay SDK, provided by Tencent, with the purpose of payment, embedded in the iOS and Android applications and in the WeChat Mini-Program. The personal information it collects is the WeChat User OpenId. The appendix links to the SDK's own privacy policy.
Supporting quotations
WeChat Pay
Provider of the SDK
Tencent
Purposes of the SDK
Payment
Application where the SDK is embedded
iOS, Android, WeChat Mini-Program
Types of personal information collected by the SDK
The SDK is embedded in the iOS and Android applications and in the WeChat Mini-Program.
Data Access & Collection · Company practice
Third-party SDK: Adobe Analytics for the WeChat Mini-Program
The China appendix lists the Adobe Analytics SDK for WeChat Mini-Program, provided by Adobe, with the purpose of user clicks and usage records, embedded in the WeChat Mini-Program. The types of personal information collected by the SDK are location information, device information and the version of the operating system. The appendix links to the SDK's own privacy policy.
Supporting quotations
Adobe Analytics SDK for WeChat Mini-Program
Provider of the SDK
Adobe
Purposes of the SDK
User clicks and usage records
Application where the SDK is embedded
WeChat Mini-Program
Types of personal information collected by the SDK
Location information, device information, version of operating system
This SDK is embedded in the WeChat Mini-Program only.
Data Access & Collection · Company practice
Third-party SDK: Adobe Analytics
The China appendix lists the Adobe Analytics SDK, provided by Adobe, with the purpose of user clicks and usage records, embedded in the iOS and Android applications. The types of personal information collected by the SDK are location information, device information and the version of the operating system. The appendix links to the SDK's own privacy policy, which is a document this source does not contain.
Supporting quotations
Adobe Analytics SDK
Provider of the SDK
Adobe
Purposes of the SDK
User clicks and usage records
Application where the SDK is embedded
iOS, Android
Types of personal information collected by the SDK
Location information, device information, version of operating system
This SDK is embedded in the iOS and Android applications.
Not stated here
The linked Adobe privacy policy for China is not supplied in this source, so this card cannot say what it requires.
Data Access & Collection · Company practice
Third-party SDK: Baidu Maps
The China appendix lists the Baidu Maps SDK, provided by Baidu, with the purpose of displaying hotels nearby on the map, embedded in the Android application. The types of personal information it collects are set out in the next part of the appendix.
Supporting quotations
Baidu Maps SDK
Provider of the SDK
Baidu
Purposes of the SDK
Displaying hotels nearby on the map
Application where the SDK is embedded
Android
Qualifications & exceptions
This SDK is embedded in the Android application only.
Only the provider, purpose and application are stated in this part; the data types follow in the next part.
Data Access & Collection · Company practice
Third-party SDK: Baidu Maps — the data types collected
The China appendix lists the Baidu Maps SDK as embedded in the Android application, and states that it collects geolocation and device environment information: latitude and longitude coordinates, Android ID, GNSS information, Wi-Fi gateway address, BSSID, SSID, Wi-Fi signal strength, Wi-Fi status, Wi-Fi configuration data, available Wi-Fi network information, cellular base station data, mobile carrier information, device signal strength data, IP address, Bluetooth information, and sensor data such as accelerometer, gyroscope, orientation, pressure, rotation vector, ambient light and magnetometer data. The appendix links to the SDK's own privacy policy.
Supporting quotations
Android
Types of personal information collected by the SDK
Geolocation and Device Environment Information, including latitude and longitude coordinates, Android ID, GNSS information, Wi-Fi gateway address, BSSID, SSID, Wi-Fi signal strength, Wi-Fi status, Wi-Fi configuration data, available Wi-Fi network information, cellular base station data, mobile carrier information, device signal strength data, IP address, Bluetooth information, and sensor data (such as accelerometer, gyroscope, orientation, pressure, rotation vector, ambient light, and magnetometer data).
The list of data types is long and includes network, Bluetooth and sensor data, not only location.
The SDK is embedded in the Android application.
Data Access & Collection · Company practice
Third-party SDK: Google Maps
The China appendix lists the Google Maps SDK, provided by Google, with the purpose of displaying hotels nearby on the map, embedded in the Android application. The personal information it collects is listed as location information for domestic users. The appendix links to the SDK's own privacy policy.
Supporting quotations
Google Maps SDK
Provider of the SDK
Google
Purposes of the SDK
Displaying hotels nearby on the map
Application where the SDK is embedded
Android
Types of personal information collected by the SDK
The collected data is stated as location information for domestic users.
The SDK is embedded in the Android application.
Data Access & Collection · Company practice
Third-party SDK: Workspace one
The China appendix lists the Workspace one SDK, provided by VMWare, with the purpose of recording app crashes and error messages, embedded in the iOS and Android applications. The personal information it collects is listed as device information and the version of the operating system. The appendix links to the SDK's privacy policy, a document this source does not contain.
Supporting quotations
Workspace one
Provider of the SDK
VMWare
Purposes of the SDK
Recording app crashes and error messages
Application where the SDK is embedded
iOS, Android
Types of personal information collected by the SDK
The stated purpose is diagnostic: recording app crashes and error messages.
The SDK is embedded in the iOS and Android applications.
Not stated here
The linked Broadcom legal and privacy document is not supplied in this source, so this card cannot say what it requires.
Data Access & Collection · Company practice
Third-party SDK: Xiaomi Push
The China appendix lists the Xiaomi Push SDK, provided by Xiaomi Singapore Pte. Ltd., with the purpose of push notification services, embedded in the Android application. The personal information it collects is listed as the OAID (Open Anonymous Device Identifier) and the encrypted Android ID. The appendix links to the SDK's own privacy policy.
Supporting quotations
Xiaomi Push SDK
Provider of the SDK
Xiaomi Singapore Pte. Ltd.
Purposes of the SDK
Push notification services
Application where the SDK is embedded
Android
Types of personal information collected by the SDK
OAID (Open Anonymous Device Identifier) and encrypted Android ID
The identifiers collected are the OAID and the encrypted Android ID.
The SDK is embedded in the Android application.
Data Access & Collection · Company practice
Third-party SDK: OPPO Push
The China appendix lists the OPPO Push SDK, provided by Guangdong Heytap Technology Co., Ltd., with the purpose of push notification services, embedded in the Android application. The types of personal information collected are given at length: device-related information such as IMEI, OAID, serial number, IMSI, user ID, Android ID, Google Advertising ID, device region settings, device model, battery level, operating system version and language settings; application information such as package name, version and running status; the Push SDK version; network-related information such as IP address or domain name connection results and network type; message delivery results; notification status information such as permissions and user interaction data; and lock screen status information. The appendix links to the SDK's own privacy policy.
Supporting quotations
OPPO Push SDK
Provider of the SDK
Guangdong Heytap Technology Co., Ltd.
Purposes of the SDK
Push notification services
Application where the SDK is embedded
Android
Types of personal information collected by the SDK
Device-related information (e.g., IMEI, OAID, serial number, IMSI, user ID, Android ID, Google Advertising ID, device region settings, device model, battery level, operating system version, and language settings); application information (e.g., APP package name, version, and running status); Push SDK version; network-related information (e.g., IP address or domain name connection results, and network type); message delivery results; notification status information (e.g., notification permissions and user interaction data); and lock screen status information (e.g., lock status and lock-screen notification settings).
The collected categories include advertising and device identifiers, message delivery results and lock-screen status.
The SDK is embedded in the Android application.
Data Access & Collection · Company practice
Third-party SDK: Geetest Captcha — anti-robot data collected
The China appendix lists the Geetest Captcha SDK, provided by Geetest, with the purpose of anti-robot attack, embedded in the iOS, Android and WeChat Mini Program applications. It sets out five categories of data: device information such as operating system information, manufacturer, model and brand, which after de-identification is used to build abnormal traffic detection models; device network information such as connection status and network type, used after de-identification for abnormal activity and virtual device detection; device environment information such as screen size, battery charging status, battery level, jailbreak or root indicators, debugging indicators and mobile network operator name; user behavioural trajectory information, which it explains refers to interaction trajectory data from the verification process — swipe patterns, click patterns and mouse movement trajectories — rather than page-to-page navigation data, used after de-identification to detect simulated, brute-force and forged interaction trajectories; and other information such as verification timestamps and application package names, used for baseline auxiliary models of abnormal activity detection. The appendix links to the SDK's own privacy policy.
Supporting quotations
Geetest Captcha SDK
Provider of the SDK
Geetest
Purposes of the SDK
Anti-robot attack
Application where the SDK is embedded
iOS, Android, WeChat Mini Program
Types of personal information collected by the SDK
Device Information: Information such as device operating system information, device manufacturer information, device model, and device brand. After de-identification, such information is used to establish abnormal traffic detection models and support traffic anti-fraud technologies.
Device Network Information: Information such as the device's network connection status and network type. After de-identification, such information is used to establish abnormal activity and virtual device detection models and support traffic anti-fraud technologies.
Device Environment Information: Information such as device screen size, battery charging status, battery level, device jailbreak/root indicators, device debugging indicators, and mobile network operator name. After de-identification, such information is used to establish abnormal activity and virtual device detection models and support traffic anti-fraud technologies.
User Behavioral Trajectory Information: This category of information does not refer to business process navigation data generated when a user moves from one page to another. Rather, it refers to interaction trajectory data generated during the verification process, such as swipe patterns, click patterns, and mouse movement trajectories. After de-identification, such information is used to establish models for detecting simulated, brute-force, and forged interaction trajectories and to support traffic anti-fraud technologies.
Other Information: Information such as verification timestamps and application package names. Such information is used to establish baseline auxiliary models for abnormal activity detection and to support traffic anti-fraud technologies.
The stated purpose is anti-robot attack, and each category is said to be used after de-identification for detection models.
The behavioural trajectory category is expressly distinguished from page-to-page navigation data.
The SDK is embedded in the iOS, Android and WeChat Mini Program applications.
Data Access & Collection · Context
Third-party SDK: Geetest Captcha privacy policy link
The Geetest Captcha entry in the China appendix ends with a link to the SDK's own privacy policy, which is a document this source does not supply. The SDK details themselves are set out in the preceding part of the appendix.
The linked policy governs the SDK's own processing and is not reproduced here.
Data Access & Collection · Company practice
Third-party SDK: DeepZero DeepTrack
The China appendix lists the DeepZero DeepTrack SDK, provided by DeepZero, with the purpose of campaign performance tracking, embedded in the iOS, Android and WeChat Mini-Program applications. The personal information it collects is listed as location information, device information, version of the operating system, user identity identifier, behavioral information and channel promotion information. The appendix links to the SDK's own privacy policy.
Supporting quotations
DeepZero DeepTrack SDK
Provider of the SDK
DeepZero
Purposes of the SDK
Campaign Performance Tracking
Application where the SDK is embedded
iOS, Android, WeChat Mini-Program
Types of personal information collected by the SDK
Location Information, Device Information, Version of Operating System, User identity identifier, Behavioral information, Channel promotion information
Link to the privacy policy of the SDK
https://deeptrack.deepzero.com/docs/privacy
Qualifications & exceptions
The stated purpose is campaign performance tracking.
The SDK is embedded in the iOS, Android and WeChat Mini-Program applications.
Sharing & Disclosure · Company practice
China: transfer of personal information to third parties with consent and safeguards
Section 3.4 of the China appendix says that with the person's consent, Hilton may transfer their personal information to third parties for the purposes described in the Statement, and that before any such transfer it will ensure that appropriate notice and safeguards are in place. The transfer is thus stated as consent-based and as preceded by notice and safeguards.
Supporting quotations
3.4 Transfer of Personal Information
With your consent, we may transfer your personal information to third parties for the purposes as described in this Statement.
Prior to the transfer of your personal information, we will ensure that appropriate notice and safeguards are in place.
Qualifications & exceptions
The transfer is stated to be on the basis of consent.
Appropriate notice and safeguards are stated to be in place before the transfer.
Sharing & Disclosure · Company practice
China: disclosure of personal information to third parties for five stated reasons
Section 3.5 of the China appendix says that despite the other situations described, Hilton may disclose personal information to third parties in order to: comply with applicable laws or effective legal procedures; respond to enquiries of governments or to requests of public or government authorities; protect the rights, privacy, security or property of Hilton, site visitors, guests, employees or the public; pursue or exercise Hilton's own rights; or respond to emergencies. The grounds include protecting Hilton's own rights and property, not only others'.
Supporting quotations
3.5 Disclosure of Personal Information
Despite the above situations, we may disclose personal information to third parties to: comply with applicable laws or effective legal procedures; respond to enquiries of the governments or requests of the public and/or the government authorities; protect rights, privacy, security or property of Hilton, site visitors, guests, employees or the public; pursue or exercise our rights; or respond to emergencies.
Qualifications & exceptions
The disclosure is stated to apply despite the other situations described in the appendix.
One ground is pursuing or exercising Hilton's own rights.
Data Access & Collection · Company practice
China: mobile and location services, and the device setting that limits the collection
The China appendix says Hilton may collect personal information if a person downloads and uses its mobile applications or uses other digital platforms such as its WeChat Mini-Programs, and that it will obtain consent and process the information in accordance with the Statement. If the person allows access to location information on the device to provide application features and services, that information may include geolocation information; Hilton also collects device information such as phone brand, model, operating system and operating system version to direct the person to the appropriate app store. It says the collection can be prevented or limited by changing the settings in the Hilton Honors app or on the device.
Supporting quotations
4. Mobile and Location Services
We may collect your personal information if you download and use our mobile applications or use other digital platforms such as our WeChat Mini-Programs.
We will obtain your consent and collect, use, disclose and otherwise process this information in accordance with this Statement.
If you allow us to access the location information on your device to provide you with our application features and services, such information may include geolocation information.
We also collect device information, such as your phone brand, model, operating system, operating system version, to direct you to the appropriate APP store to download our mobile apps.
You can prevent or limit the collection of this information by changing the settings in the Hilton Honors APP or by changing the settings in your device.
Qualifications & exceptions
Consent is obtained and the collection is stated to depend on the app being downloaded and used.
The location collection depends on the person allowing device location access.
The device information is collected to point the user to the right app store.
The collection can be prevented or limited through app or device settings.
Sharing & Disclosure · User right or choice
China: targeted advertising with third parties, and the opt-out
The China appendix says Hilton cooperates with third parties to serve targeted advertising based on a person's online activities across different websites, mobile applications and devices over time, and that the advertising partners may collect information about the person's activities related to Hilton's services on their current device and combine it with information about their activities on other websites, mobile applications and devices, using server logs, cookies, web beacons, tags, pixels, mobile advertising IDs, cross-device linking and similar technologies, and that this may include the person's personal information. It says the person can opt out of interest-based advertising and cross-device linking in the current browser or the mobile apps on the device, and that Hilton does not currently respond to 'do not track' signals, referring to the main body of the Statement for more information.
Supporting quotations
5. Analytics and Interest-Based Advertisements
We also cooperate with third parties to serve targeted advertising based on your online activities across different websites, mobile applications, and devices over time.
They may collect this information using server logs, cookies, web beacons, tags, pixels, mobile advertising IDs, cross-device linking and similar technologies. This may include your personal information.
You can opt out of interest-based advertising and cross-device linking in the current browser or the web browsers and mobile apps on your device.
We do not currently respond to "do not track" signals.
Qualifications & exceptions
The cross-device combination 'may include your personal information'.
The opt-out is available in the current browser or the mobile apps on the device.
Do Not Track signals are not responded to, consistently with the main body.
Legal Rights & Agreement Rules · User right or choice
China: rights over personal information and the 15-day deregistration response
The China appendix states that the person has the right to access, correct and, in certain circumstances, delete their personal information, to withdraw consent to Hilton's processing, to deregister their membership account if any, to object to the use of their personal information in automated decision making, and to make complaints about how Hilton processes their personal information, and that they may have other rights under other applicable laws. It says Hilton seeks to handle these requests within the legally required period, and in particular will respond to a deregistration request within 15 days of receipt, unless there are extenuating circumstances, in which case it will inform the person of the anticipated timeline. It notes that after deregistration the person can no longer enjoy membership benefits, and that the personal information will be deleted or anonymized unless the applicable laws require retention.
Supporting quotations
6. Changing and Accessing Your Personal Information, and Deregistration of Accounts
You have the right to access, correct and/or (in certain circumstances) delete your personal information, withdraw consent to our processing of your personal information, deregister your membership account (if any), object to the use of your personal information in automated decision making and make complaints about how we process your personal information.
we will respond to your request to deregister within 15 days of our receipt of the request, unless there are extenuating circumstances, in which we will inform you of the anticipated timeline if we expect our response to take longer than 15 days.
if you request to deregister your membership account, you will no longer be able to enjoy any membership benefits from the date of deregistration.
After you deregistered your membership account, your personal information will be deleted or anonymized unless the applicable laws require us to retain this information.
Qualifications & exceptions
Deletion is available only 'in certain circumstances'.
The 15-day response applies to deregistration requests and may be extended in extenuating circumstances.
Membership benefits end from the date of deregistration, and information is deleted or anonymized unless retention is required.
Security & Safeguards · Company commitment
China: reasonable steps to protect personal information, as in the main body
The China appendix says Hilton takes reasonable steps to protect personal information from unauthorized access, disclosure, alteration or destruction, and to keep personal information appropriately accurate and current by using appropriate technical and organizational measures, and refers the reader to the How We Protect Personal Information section of the main body for more information.
Supporting quotations
7. How We Protect Personal Information
We take reasonable steps to: (i) protect personal information from unauthorized access, disclosure, alteration, or destruction, and (ii) keep personal information appropriately accurate and current by using appropriate technical and organizational measures.
Qualifications & exceptions
The commitment is to reasonable steps and appropriate technical and organizational measures.
The detail is in the main body rather than in the appendix.
Sharing & Disclosure · Restriction or exception
China: Hilton is not responsible for third-party websites and applications
The China appendix states that Hilton is not responsible for the collection, use, disclosure or other processing of personal information by third-party websites or applications, and asks readers to read those sites' privacy policies and terms of use. It says this applies to three situations: in-hotel internet services it may offer; third-party websites and applications to which links in its own sites and mobile applications may lead; and third-party digital messaging applications or platforms it uses to communicate with the person.
Supporting quotations
We are not responsible for the collection, use, disclosure, or otherwise processing of personal information by our third-party websites or applications.
This applies to: (1) in-hotel internet services we may offer; (2) third-party websites and applications to which the links in our websites and mobile applications may direct; and (3) third-party digital messaging applications or platforms which we use to communicate with you.
Qualifications & exceptions
The exclusion covers three named situations, including in-hotel internet services.
The reader is directed to the third party's own policies for that processing.
Sharing & Disclosure · Company practice
China: transfers outside China, to the global reservation system in the United States
The China appendix says that as Hilton operates globally, with the person's express consent where required, it may transfer personal information — including sensitive personal information where applicable — to jurisdictions outside China, including the United States, Europe and other jurisdictions where Hilton, its service providers and other third parties conduct business. It says the information may in particular be transferred to Hilton Domestic Operating Company Inc. for storage and processing in accordance with the Statement via Hilton's global centralized reservation system, which is deployed in the United States, and that information in that system may be further transferred to properties in different countries according to the person's reservations, with the Data Protection Office named as the contact for the other entities that may receive the information. It adds that Hilton will take appropriate steps to protect the integrity and confidentiality of the information and ensure it is processed in accordance with the main body of the Statement and applicable law.
Supporting quotations
8. International Transfers of Personal Information
As Hilton operates globally, with your express consent where required, we may transfer your personal information (including your sensitive personal information, if applicable) to jurisdictions outside of China, including United States, Europe, and other jurisdictions where we, our service providers, and other relevant third parties conduct business.
your personal information may be transferred to Hilton Domestic Operating Company Inc. for storage and processing in accordance with this Statement via Hilton's global centralized reservation system, which is deployed in the United States.
The personal information stored in Hilton's global centralized reservation system may be further transferred to properties in different countries based on your reservations in accordance with this Statement.
We will take appropriate steps to protect the integrity and confidentiality of your information and to ensure that your personal information is processed in accordance with the main body of this Statement and in accordance with the applicable laws.
Qualifications & exceptions
The transfer is stated as conditional on express consent where required.
The central destination is the global centralized reservation system deployed in the United States, and information may then move to properties in other countries.
The safeguard is stated as appropriate steps protecting integrity and confidentiality.
Retention & Deletion · Company practice
China: retention for the collection purpose or as the law requires, with destruction under the retention procedures
The China appendix says Hilton will retain personal information for as long as necessary to complete the purpose for which it was collected, or as required or permitted by applicable law, and that it will destroy personal information in accordance with its retention and records management procedures, referring to the main body's Data Retention Period section for more information.
Supporting quotations
9. Data Retention Period
We will retain personal information about you for as long as necessary to complete the purpose for which it was collected, or as required or permitted by the applicable laws.
We will destroy your personal information in accordance with our retention and records management procedures.
Qualifications & exceptions
Retention is tied to the collection purpose or to what the law requires or permits.
Destruction follows Hilton's own retention and records management procedures.
Legal Rights & Agreement Rules · Company practice
China: publication of material changes, and notice or consent where local law requires
The China appendix says that if Hilton makes material changes to the Statement it will publish them, referring to the main body's Changes to Statement section for more information, and that if required by local laws it will notify the person and/or seek their consent.
Supporting quotations
10. Changes to This Statement
If we make material changes to this Statement, we will publish these changes.
If required by the local laws, we will notify you and/or seek your consent.
Qualifications & exceptions
Notification and consent are conditional on what local law requires.
The publication commitment is stated for material changes.
Legal Rights & Agreement Rules · Context
China: contact the Data Protection Office or the China privacy contact
Section 11 of the China appendix states that a person can contact Hilton for questions, requests or complaints regarding the protection of personal information, giving the Data Protection Office email address and, for contact in China, a separate China privacy email address. This is the section 11 that the China appendix's own rights passage points to.
Supporting quotations
11. Contact Information for Questions or Concerns
You can contact us if you have any questions, requests, or complaints regarding the protection of personal information.
or, if you would like to get in touch with the contact in China, please contact: China_Privacy@hilton.com
Qualifications & exceptions
A China-specific contact address is given in addition to the Data Protection Office.
Legal Rights & Agreement Rules · Context
Brazil: the LGPD appendix applies to people in Brazil, and leaves the rest of the Statement in force
The Brazil appendix says that to the extent a person is located in Brazil or is in any form subject to the Brazilian General Data Protection Law, Federal Law nº 13709/18, referred to as the LGPD, the provisions it indicates should be read and applied to the processing of the person's personal data accordingly. Unless stated otherwise in that appendix, the remainder of the Policy, including Appendix A as applicable, does not vary and remains in full force and effect.
Supporting quotations
Appendix A-7: Brazil Residents
To the extent you are located within Brazil or are in any form subject to the Brazilian General Data Protection Law – Federal Law nº 13709/18 (“LGPD”), the provisions indicated below should be read and applied to the processing of your personal data accordingly.
Unless stated otherwise in this Appendix, the remainder of the Policy, including Appendix A as applicable, shall not vary and shall remain in full force and effect.
Qualifications & exceptions
The appendix applies to people located in Brazil and to anyone subject to the LGPD in any form.
Unless the appendix says otherwise, the rest of the Statement is unchanged.
Legal Rights & Agreement Rules · User right or choice
Brazil: the data subject rights under the LGPD
The Brazil appendix says that under certain circumstances a person has the following rights under the LGPD in relation to their personal data: the right to information, meaning clear, transparent and understandable information on how Hilton uses the data; the right of confirmation and access; the right of rectification, where the data is outdated, inaccurate or incorrect or needs completing; the right of anonymization, blocking or deletion of any unnecessary or excessive data or data processed in non-compliance with applicable law; the right to withdraw consent at any time for consent-based processing; the right to data portability, to copy or transfer the data to another database in accordance with further regulation of the local authority; the right to receive information about the public and private entities with which the data is shared; the right to object to processing based on a legal basis other than consent where the LGPD is violated; the right to review decisions based solely on automated processing, reviewed by a natural person, where they affect the person's interests; and the right to file a complaint with the local data protection authority or consumer protection entities. The rights are stated to apply 'under certain circumstances'.
Supporting quotations
1. Data Subjects Rights
Under certain circumstances, you have the following rights under the LGPD in relation to your personal data:
Right to Information: right to obtain clear, transparent and understandable information on how we use your personal data;
Right of confirmation and access: right to receive confirmation and access your personal data held by us about you;
Right of rectification: right to have your personal data corrected if they are outdated, inaccurate or incorrect and/or to complete them;
Right of anonymization, blocking or deletion: Anonymize, block or eliminate any unnecessary or excessive data or data processed in noncompliance with the applicable law;
Right to withdraw consent at any time for consent-based data processing: right to withdraw your consent to the processing of your personal data when such processing is based on consent;
Right to data portability: right to request copying, transferring your personal data to another database in accordance with further regulation of the local authority;
Right to receive information about public and privacy entities: right to receive information about public and private entities with which your personal data is shared;
Right to object: right to oppose any processing activity based on a legal basis other than consent in case there is violation of the LGPD;
Right to review automated decisions: right to review of decisions, whenever they are based only on automated processing of personal data, by a natural person, whenever it affects your interests;
Right to file a complaint with your local Data Protection Authority or consumer protection entities.
Qualifications & exceptions
The rights are stated to apply only under certain circumstances.
Data portability is subject to further regulation of the local authority.
The right to review automated decisions requires review by a natural person and applies where the decision affects the person's interests.
Legal Rights & Agreement Rules · Company practice
Brazil: the legal bases relied on under Article 7 of the LGPD
The Brazil appendix says Hilton usually relies on one of the following legal bases when processing personal data for the purposes indicated in the Statement, in accordance with Article 7 of the LGPD: the data subject's consent; compliance with a legal or regulatory obligation; performance of a contract or preliminary procedures relating to a contract to which the data subject is a party; and the legitimate interests of the controller or of third parties, except where the fundamental rights of the data subject prevail. It adds that other legal bases set out in the LGPD may apply depending on the concrete situation. The article numbers are cited; the appendix does not reproduce the law.
Supporting quotations
2. Legal Bases
Hilton usually relies on one of the following legal bases when processing your personal data for the purposes indicated in the Global Privacy Statement in accordance with Article 7 of the LGPD:
Data subject’s consent (art. 7, I);
For compliance of a legal or regulatory obligation (Article 7, II);
Whenever necessary for the performance of a contract or preliminary procedures relating to contracts in which the data subject is a party (Article 7, V);
Whenever necessary for the legitimate interests of the controller or of third parties, except in the prevalence of fundamental rights of the data subject (Article 7, IX).
However, depending on the concrete situation, other legal bases set forth in the LGPD may apply.
Qualifications & exceptions
The bases are those Hilton 'usually' relies on; other LGPD bases may apply in a particular situation.
The legitimate-interest basis is qualified by the fundamental rights of the data subject prevailing.
Sharing & Disclosure · Company practice
Brazil: how transfers out of Brazil are managed
The Brazil appendix says that where information originating in Brazil is transferred to a country outside Brazil, it will take steps to make sure the transfer is carefully managed to protect privacy rights. It describes three routes: transfers within the Hilton Group of Companies may be covered by an intra-group agreement that contractually obliges each member to ensure an adequate and consistent level of protection wherever the information is transferred within Hilton in accordance with the LGPD; transfers outside the group, including to service providers, are covered by contractual commitments and assurances such as standard contractual clauses or binding corporate rules, and in the absence of instructions from the local supervisory authority Hilton may follow the standard models adopted under European Union or other competent authorities' models; and Hilton may also transfer to countries recognised as providing an adequate level of legal protection, or where it is satisfied alternative arrangements are in place. It invites requests for the specific mechanism used.
Supporting quotations
3. International Transfers
Where we transfer information that originates in Brazil to a country outside of Brazil, we will take steps to make sure such transfer is carefully managed to protect your privacy rights:
transfers within the Hilton Group of Companies may be covered by an agreement entered into by members of Hilton (an intra-group agreement) which contractually obliges each member to ensure that your information receives an adequate and consistent level of protection wherever it is transferred within Hilton in accordance with the LGPD;
where we transfer your data outside of the Hilton Group of Companies, including to other companies providing us with a service, we will obtain contractual commitments and assurances from them to protect your information, such as standard contractual clauses or binding corporate rules.
In the lack of instructions from the local supervisory authority, we may follow the standard models adopted under the European Union or by other competent authorities until then;
we are also able to transfer personal information to countries which are recognized as providing an adequate level of legal protection or where we can be satisfied that alternative arrangements are in place to protect your privacy rights; and
Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of Brazil.
Qualifications & exceptions
Intra-group transfers rest on an intra-group agreement; transfers outside the group rest on contractual commitments and assurances.
The standard models used pending local supervisory authority instructions are the European Union's or other competent authorities' models.
Transfer to adequacy-recognised countries is also stated as available.
Legal Rights & Agreement Rules · Context
Monaco: the appendix for data subjects in the Principality, controlling over the main body on conflict
The Monaco appendix says that for data subjects in the Principality of Monaco it outlines certain additional information Hilton is obliged to provide and certain rights they have with respect to the processing of their personal data, pursuant to applicable local laws, and that it controls to the extent it conflicts with any provision in the main body of the Statement or in Appendix A.
Supporting quotations
Appendix A-8: Monaco Residents
For data subjects in the Principality of Monaco, this Appendix outlines certain additional information that Hilton is obligated to provide to you, as well as certain rights you have with respect to the processing of your personal data, pursuant to applicable local laws.
This Appendix will control to the extent it conflicts with any provision in the main body of this Statement or Appendix A, as applicable.
Qualifications & exceptions
The appendix controls over the main body and Appendix A where they conflict.
Legal Rights & Agreement Rules · Company practice
Monaco: legal bases under Act No. 1.054
The Monaco appendix states that Hilton relies on legal bases while processing personal data for the purposes indicated in the main body of the Global Privacy Statement, in accordance with Act No. 1.054 on the Protection of Personal Data. The appendix names the act and does not set out its terms or the specific bases relied on.
Supporting quotations
1. Legal Bases for the Processing Of Your Personal Data
Hilton relies on legal bases while processing your personal data for the purposes indicated in the main body of the Global Privacy Statement in accordance with Act No. 1.054 on the Protection of Personal Data ("Act No. 1.054").
Qualifications & exceptions
The act is cited but the specific bases are not listed in this section.
Legal Rights & Agreement Rules · User right or choice
Monaco: rights under Act No. 1.054 and the route to the Personal Data Protection Authority
The Monaco appendix states that, in accordance with Act No. 1.054, the person has rights of access to, and of rectification, erasure and portability of, their personal data, as well as rights to object to and restrict its processing, and that with proof of identity they may exercise these rights by contacting the Data Protection Office by email. It adds that if, after contacting the DPO, the person does not feel their rights have been observed, they may make a claim with the Personal Data Protection Authority.
Supporting quotations
2. Personal Data Access and Customer Rights
you have a right of access to and a right to the rectification, erasure and portability of your personal data as well as a right to object and restrict the processing of this personal data.
With proof of your identity, you may exercise your rights by contacting the Data Protection Office ("DPO") by email at DataProtectionOffice@hilton.com
If, after contacting the DPO, you do not feel that your rights have been observed, you may make a claim with the Personal Data Protection Authority ("APDP")
Qualifications & exceptions
Proof of identity is required to exercise the rights.
The authority complaint is the step after contacting the Data Protection Office.
Security & Safeguards · Company commitment
Monaco: notification and mitigation for a high-risk personal data breach
The Monaco appendix states that in case of a breach of personal data liable to pose a high risk to the person's rights and freedoms, Hilton shall inform the person as soon as possible and take all necessary measures to limit the risks related to the breach. It adds that whether the data is processed by Hilton or by its subcontractors and partners, the same security and privacy requirements apply.
Supporting quotations
3. Personal Data Security
In case of breach of your personal data liable to pose a high risk to your rights and freedoms, Hilton shall inform you as soon as possible and take all necessary measures to limit the risks related to this breach.
Whether your data is processed by Hilton or by its subcontractors and partners, the same security and privacy requirements apply to your personal data.
Qualifications & exceptions
The notification duty is tied to a breach liable to pose a high risk.
The same requirements are stated to apply to subcontractors and partners.
Sharing & Disclosure · Company practice
Monaco: transfers to affiliates outside Monaco and the transfer authorization form
The Monaco appendix states that Hilton is required to transfer personal data to its affiliates outside the Principality of Monaco, which includes Hilton Domestic Operating Company Inc. and its in-country suppliers, all resident in the United States, in order to complete reservations, process Hilton Honors memberships and conduct promotion activities through a website whose servers are located abroad. It adds that where a subcontractor or partner is located in a country not recognised as offering an adequate level of protection under Act No. 1.054 — which it says is the case for the United States — Hilton must fulfil a transfer authorization form to comply with the act's requirements, and the subcontractors should ensure satisfactory protection of the personal data.
Supporting quotations
4. International Transfers of Personal Data
Hilton is required to transfer your personal data to its affiliates outside of the Principality of Monaco which includes Hilton Domestic Operating Company Inc., all resident in the United States, as well as their in-country suppliers, in order to complete reservations, process Hilton Honors memberships and conduct promotion activities through its website, whose servers are located abroad.
When a subcontractor or partner is located in a country that has not been recognized as having an adequate level of protection as the one offered by Act No. 1.054 (which is the case for the United States), Hilton must fulfill a transfer authorization form in order to comply with Act No. 1.054’s own requirements on the security and privacy of personal data and the subcontractors should ensure a satisfactory protection of your personal data.
Qualifications & exceptions
The United States is stated not to be recognised as offering an adequate level of protection under Act No. 1.054.
The transfer authorization form is Hilton's own compliance step; protection is also stated as something subcontractors should ensure.
Legal Rights & Agreement Rules · Context
Monaco: the English text prevails over the French text
The Monaco appendix states that the statement is available in English and French, and that if there is any inconsistency or different interpretation between the English and French versions, the English text prevails. The source analysed here is that English text.
Supporting quotations
5. Language
This statement is available in English and French. If there is any inconsistency or different interpretation between the English and French versions, the English text shall prevail.
Qualifications & exceptions
The English text prevails over the French text in case of inconsistency or different interpretation.
Legal Rights & Agreement Rules · Context
Nigeria: the NDPA appendix applies to people in Nigeria and controls over the main body
The Nigeria appendix says that to the extent a person is located in Nigeria or is in any form subject to the Nigeria Data Protection Act 2023, referred to as the NDPA, the provisions it indicates should be read and applied to the processing of their personal information accordingly, and that the appendix controls to the extent it conflicts with any provision in the main body of the Statement or in Appendix A.
Supporting quotations
Appendix A-9: Nigeria Residents
To the extent you are located within Nigeria or are in any form subject to the Nigeria Data Protection Act 2023 (NDPA), the provisions indicated below should be read and applied to the processing or your personal information accordingly.
This Appendix will control to the extent it conflicts with any provision in the main body of this Statement or Appendix A, as applicable.
Qualifications & exceptions
The appendix applies to people located in Nigeria and to anyone subject to the NDPA in any form.
The appendix controls over the main body and Appendix A where they conflict.
Legal Rights & Agreement Rules · Company practice
Nigeria: the legal grounds relied on under the NDPA
The Nigeria appendix says that in accordance with the NDPA, Hilton processes personal information for the purposes indicated in the Global Privacy Statement on the following legal grounds: consent, where the person has given explicit consent for specific processing activities; contractual necessity, to fulfil obligations under a contract with the person such as processing reservations and providing requested services; legal obligation, to comply with applicable Nigerian laws and regulatory requirements; and legitimate interests, to pursue Hilton's legitimate business interests, provided that such processing does not override the person's fundamental rights and freedoms.
Supporting quotations
1. Legal Basis for Processing
In accordance with the NDPA, we process your personal information for the purposes indicated in the Global Privacy Statement based on the following legal grounds:
Consent: Where you have provided explicit consent for specific processing activities.
Contractual Necessity: To fulfill our obligations under a contract with you, such as processing reservations and providing requested services.
Legal Obligation: To comply with applicable Nigerian laws and regulatory requirements.
Legitimate Interests: To pursue our legitimate business interests, provided that such processing does not override your fundamental rights and freedoms.
Qualifications & exceptions
The legitimate-interest ground is qualified by the person's fundamental rights and freedoms.
The contractual ground is illustrated with reservations and requested services.
Legal Rights & Agreement Rules · User right or choice
Nigeria: the rights of Nigerian data subjects
The Nigeria appendix says that as a resident of Nigeria the person is entitled to the following rights under the NDPA: to access, meaning confirmation of whether their personal information is being processed and access to it; to rectification of inaccurate or incomplete information; to erasure, which may be requested in certain circumstances such as when the data is no longer necessary for the purposes collected; to restrict processing in specific situations; to data portability, meaning receiving the information in a structured, commonly used and machine-readable format and transmitting it to another data controller; to object to processing based on legitimate interests or for direct marketing; to withdraw consent at any time without affecting the lawfulness of processing before withdrawal; and to lodge complaints with the Nigeria Data Protection Commission.
Supporting quotations
2. Rights of Nigerian Data Subjects
As a resident of Nigeria, you are entitled to the following rights under the NDPA:
Right to Access: You may request confirmation as to whether your personal information is being processed and, if so, access to that information.
Right to Rectification: You have the right to request the correction of inaccurate or incomplete personal information.
Right to Erasure: You can request the deletion of your personal information under certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected.
Right to Restrict Processing: You may request that we limit the processing of your personal information in specific situations.
Right to Data Portability: You have the right to receive your personal information in a structured, commonly used, and machine-readable format and to transmit that data to another data controller.
Right to Object: You can object to the processing of your personal information based on legitimate interests or for direct marketing purposes.
Right to Withdraw Consent: If processing is based on consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
Right to Lodge Complaint: You have a right to lodge complaints with the Nigeria Data Protection Commission (NDPC).
Qualifications & exceptions
Erasure is available only in certain circumstances, with an example given.
Restriction is available in specific situations.
Withdrawing consent does not affect the lawfulness of processing before the withdrawal.
Sharing & Disclosure · Company practice
Nigeria: transfers to third parties and safeguards on transfer outside Nigeria
The Nigeria appendix says Hilton may transfer personal information to third parties, including entities within the Hilton group and external service providers, for the purposes described in the Statement, and that when transferring personal information outside Nigeria it ensures appropriate safeguards are in place in accordance with the NDPA.
Supporting quotations
3. Data Transfer and Sharing
We may transfer your personal information to third parties, including entities within the Hilton group and external service providers, for the purposes described in this Privacy Statement.
When transferring personal information outside Nigeria, we ensure that appropriate safeguards are in place to protect your data in accordance with the NDPA.
Qualifications & exceptions
Recipients include entities within the Hilton group as well as external service providers.
Safeguards are stated for transfers outside Nigeria.
Security & Safeguards · Company commitment
Nigeria: reasonable steps to protect personal information, as in the main body
The Nigeria appendix states that Hilton takes reasonable steps to protect personal information from unauthorized access, disclosure, alteration or destruction, and to keep it appropriately accurate and current by using appropriate technical and organizational measures, referring to the How We Protect Personal Information section of the main body for more information.
Supporting quotations
4. How We Protect Your Personal Data
We take reasonable steps to: (i) protect personal information from unauthorized access, disclosure, alteration, or destruction, and (ii) keep personal information appropriately accurate and current by using appropriate technical and organizational measures.
Qualifications & exceptions
The detail is in the main body rather than in the appendix.
Retention & Deletion · Company practice
Nigeria: retention limited to the collection purposes or Nigerian law, then destruction
The Nigeria appendix states that personal information will be retained only for as long as necessary to fulfil the purposes for which it was collected or as required by Nigerian law, and that when the information is destroyed it is destroyed in a way that prevents it from being restored or reconstructed.
Supporting quotations
5. Data Retention
Your personal information will be retained only for as long as necessary to fulfill the purposes for which it was collected or as required by Nigerian law.
When we destroy your personal information, we do so in a way that prevents that information from being restored or reconstructed.
Qualifications & exceptions
The stated retention grounds are the collection purposes and Nigerian law.
Destruction is described as preventing restoration or reconstruction.
Data Access & Collection · Context
Nigeria: cookies and other technologies, as described in the main body
The Nigeria appendix says Hilton's site may use cookies or other technologies — pixel tags, web beacons, clear GIFs, links in emails, JavaScript, device IDs assigned by Google or Apple or similar — and refers the reader to the Online and Mobile Information We Collect section of the main body for more information. The appendix itself states no further detail about the use of these technologies.
Supporting quotations
6. Cookies and Other Technologies
Our site may use "Cookies" or "Other Technologies" (such as "pixel tags," "web beacons," "clear GIFs", links in emails, JavaScript, device IDs assigned by Google or Apple, or similar technologies).
Qualifications & exceptions
The detail is in the main body rather than in the appendix.
Legal Rights & Agreement Rules · Context
Nigeria: contact the Data Protection Office for questions under Nigerian law
The Nigeria appendix says that a person with questions, concerns or requests regarding the processing of their personal information under Nigerian law should contact Hilton's Data Protection Office, giving the email address DataProtectionOffice@hilton.com, and adds that Hilton is committed to addressing inquiries promptly and in accordance with the NDPA. The appendix does not give a Nigerian postal address or telephone number for the office.
Supporting quotations
7. Contact Information
If you have any questions, concerns, or requests regarding the processing of your personal information under Nigerian law, please contact our Data Protection Office at:
Email: DataProtectionOffice@hilton.com
We are committed to addressing your inquiries promptly and in accordance with the NDPA.
Qualifications & exceptions
Only an email address is given in this appendix.
The commitment is to addressing inquiries promptly and in accordance with the NDPA.
Legal Rights & Agreement Rules · Company practice
Nigeria: how changes to the Statement are published and take effect
The Nigeria appendix says Hilton may modify the Statement from time to time, that when it makes material changes it will post a link to the revised Statement on the homepage of its site, that the date at the top of the Statement shows when it was last updated, and that any changes become effective upon posting of the revised Statement on the site. Unlike the Türkiye and China appendices, this section states no consent or notification requirement.
Supporting quotations
8. Changes to this Statement
We may modify this Statement from time to time.
When we make material changes to this Statement we will post a link to the revised Statement on the homepage of our site.
Any changes to our Statement will become effective upon posting of the revised Statement on the site.
Qualifications & exceptions
Material changes are signalled by a link on the site homepage.
Changes take effect on posting.
Legal Rights & Agreement Rules · Context
Korea: PIPA compliance, the published processing policy, and the appendix's priority
The Korea appendix says Hilton complies with the Personal Information Protection Act (PIPA) and other applicable laws to protect the freedom and rights of data subjects, handles personal information lawfully and manages it safely, and — in accordance with Article 30 of the PIPA — establishes and discloses the personal information processing policy set out in the appendix to guide data subjects on the procedures and standards for processing and protection and to ensure grievances are promptly and accurately resolved. The appendix controls to the extent it conflicts with the main body or Appendix A, and it applies to the extent the person is located in South Korea or is in any form subject to the PIPA.
Supporting quotations
Appendix A-10: Korea Privacy Policy
Hilton complies with the Personal Information Protection Act (PIPA) and other applicable laws to protect the freedom and the rights of data subjects, and handles personal information in a lawful manner and manages it safely.
In accordance with Article 30 of the PIPA, we establish and disclose the following personal information processing policy to guide data subjects on the procedures and standards for the processing and protection of personal information, and to ensure that grievances are promptly and accurately resolved.
This Appendix will control to the extent it conflicts with any provision in the main body of this Statement or Appendix A, as applicable.
To the extent you are located in South Korea or is any form subject to the PIPA, the provisions below should be read and applied to the processing of personal information accordingly.
Qualifications & exceptions
The processing policy is stated to be published under Article 30 of the PIPA.
The appendix controls over the main body and Appendix A where they conflict.
The Korea rules are stated to apply to people located in South Korea and those subject to the PIPA in any form.
Legal Rights & Agreement Rules · Context
Korea: the domestic local representative for information and communication services
The Korea appendix states that, in accordance with Article 32-5 of the Information and Communications Network Act, a domestic representative — a local person in charge of information and communication services — is designated, and that a person in Korea may contact the local agent by phone, email or mail to handle questions and complaints about the processing of their personal data. The local agent given is Jung Byung-hyuk (Brad Jeong), Managing Director of Conrad Seoul, with a telephone number in Seoul, a email address and a Seoul address.
Supporting quotations
Contact Information: In accordance with Article 32-5 of the Information and Communications Network Act, A domestic representative (local person) in charge of information and communication services is designated as follows:
Local Representative Agent: You may contact our Local Agent below by phone, email or mail to handle questions and complaints in connection with the processing of your personal data if you are in Korea.
Local Agent: Jung Byung-hyuk (Brad Jeong), Managing Director, Conrad Seoul
Telephone: 02-6137-7600
Email: Brad.jeong@conradhotels.com
Address: 10 Gukjegeumyuong-ro Yeouido, Seoul, 07326, South Korea
Qualifications & exceptions
The designation is made under Article 32-5 of the Information and Communications Network Act.
The local agent handles questions and complaints for people in Korea.
Legal Rights & Agreement Rules · Context
Korea: the Data Protection Office contact details and the rights portal
The Korea appendix says a person may also contact Hilton's Data Protection Office, giving a telephone number, the email address DataProtectionOffice@hilton.com, the address 7930 Jones Branch Drive, McLean, VA 22102 USA, and the Data Subject Rights Requests Portal at datarights.hilton.com. These are the same United States contact details given in the main body of the Statement.
Supporting quotations
Data Protection Office: You may also contact Hilton’s Data Protection Office.
Telephone: 070-4732-6767
Email: DataProtectionOffice@hilton.com
Address: 7930 Jones Branch Drive, McLean, VA 22102 USA
The contact point is a United States office, with a South Korean local agent given separately.
Legal Rights & Agreement Rules · Company practice
Korea: processing on consent or as the PIPA permits, and no knowing collection from under-14s
The Korea appendix says Hilton will use personal information with the person's consent or as permitted by the PIPA, and that if it wants to use it for other purposes it will obtain consent unless the new use is permitted by applicable law. It also states that Hilton does not knowingly collect, disclose or sell personal information of minors under the age of 14.
Supporting quotations
1. Processing and Retention of Personal Information
We will use your personal information with your consent or as permitted by the PIPA.
If we want to use your personal information for other purposes, we will obtain your consent unless the new use is permitted by applicable law.
Hilton does not knowingly collect, disclose, or sell personal information of minors under the age of 14.
Qualifications & exceptions
Further use needs consent only where the new use is not permitted by applicable law.
The under-14 rule is stated as a knowledge-qualified prohibition on collection, disclosure and sale.
Retention & Deletion · Company practice
Korea: retention period, storage in the United States, and destruction
The Korea appendix says Hilton retains personal information as necessary to fulfil the purpose for which it was collected, in accordance with its internal retention policies — usually for the period the data subject consented to at the time the information was collected, or for the duration of any contractual relationship, and any period afterwards as legally required under applicable laws and regulations — and that the information is stored and managed in the United States. It says personal information will be promptly destroyed at the end of the retention period, in a way that prevents it from being restored or reconstructed.
Supporting quotations
Retention Period: We retain personal information as necessary to fulfill the purpose for which that information was collected in accordance with our internal retention policies, usually for the period the data subject consented to at the time the personal information was collected, or for the duration of any contractual relationship, and any period thereafter as legally required under applicable laws and regulations.
This information is stored and managed in the United States.
Destruction and Disposal: We will promptly destroy personal information at the end of the retention period, as described above.
When we destroy personal information, we do so in a way that prevents that information from being restored or reconstructed.
Qualifications & exceptions
The retention period is tied to the consented period or the contractual relationship, plus any legally required period.
The information is stated to be stored and managed in the United States.
Destruction is stated to be prompt at the end of the retention period and to prevent reconstruction.
Legal Rights & Agreement Rules · Context
Korea: the list of personal information processed with the data subject's consent
The Korea appendix introduces the published list of items of personal information Hilton processes with the data subject's consent. Each entry that follows states the processing purpose, the legal basis under the PIPA, the sources and the items of personal information processed.
Supporting quotations
Personal information processed with the data subject’s consent. Hilton processes the following items of personal information with the data subject’s consent
Qualifications & exceptions
The list covers processing carried out on consent.
Each entry records the legal basis, the sources and the items processed.
Legal Rights & Agreement Rules · Company practice
Korea: personalization analytics — legal basis, sources and first items processed
For the processing purpose of performing analytics in order to provide guests with personalized offers and content, the Korea appendix states the legal basis as Article 15(1)(1) (Consent) of the PIPA, the sources as directly from consumers, from third parties such as travel booking platforms and credit card providers, and from demographics companies, and the items of personal information processed as name, Hilton Honors number, home address, preferred language and room preference.
Supporting quotations
Perform analytics in order to provide guests with personalized offers and content
Legal Basis
Article 15(1)(1) (Consent) of the PIPA)
Source
Directly from consumers
From third parties such as travel booking platforms and credit card providers
From demographics companies
Items of Personal Information Processed
Name
Hilton Honors number
Home address
Preferred language
Room preference
Qualifications & exceptions
The legal basis is consent under Article 15(1)(1) of the PIPA.
The remainder of the items processed for the personalization analytics purpose in the Korea appendix are internet or other electronic network activity information, including information on the customer's interaction with Hilton websites, applications or advertisements, IP addresses, session IDs, device information including MAC addresses, social media information and publicly available online information including through social media platforms, and demographic data.
Supporting quotations
Internet or other electronic network activity information, including information regarding a customer’s interaction with Hilton websites, applications, or advertisements
IP addresses
Session IDs
Device information (including MAC addresses)
Social media information; publicly available online information (including through social media platforms)
Demographic data
Qualifications & exceptions
The items include online activity, device identifiers and data from publicly available online sources.
Legal Rights & Agreement Rules · Company practice
Korea: administering contests and sweepstakes — legal basis, sources and items processed
For the processing purpose of administering contests and sweepstakes, the Korea appendix states the legal basis as Article 15(1)(1) (Consent) of the PIPA, the sources as directly from consumers themselves, from third parties such as travel booking platforms and credit card providers, and from demographics companies, and the items of personal information processed as name, email address, home address and Hilton Honors number.
Supporting quotations
Administer contests and sweepstakes
Legal Basis
Article 15(1)(1) (Consent) of the PIPA)
Source
Directly from consumers themselves
From third parties such as travel booking platforms and credit card providers
From demographics companies
Items of Personal Information Processed
Name
Email address
Home address
Hilton Honors number
Qualifications & exceptions
The legal basis is consent under Article 15(1)(1) of the PIPA.
Telephone numbers are not among the items listed for this purpose.
Legal Rights & Agreement Rules · Company practice
Korea: business analytics — legal basis, sources and first items processed
For the processing purpose of performing analytics to improve business operations, the Korea appendix states the legal basis as Article 15(1)(6) Legitimate Interest, the sources as directly from consumers, from third parties such as travel booking platforms and credit card providers, and from demographics companies, and the items of personal information processed as name, home address, Hilton Honors number, room preference and internet or other electronic network activity information.
Supporting quotations
Perform analytics to improve business operations
Legal Basis
Article 15(1)(6) Legitimate Interest
Source
Directly from consumers
From third parties such as travel booking platforms and credit card providers
From demographics companies
Items of Personal Information Processed
Name
Home address
Hilton Honors number
Room preference
Internet or other electronic network activity information, including information regarding a customer's interaction with Hilton websites, applications, or advertisements
Qualifications & exceptions
The legal basis is legitimate interest under Article 15(1)(6) of the PIPA, in contrast to consent for the personalization analytics purpose.
Legal Rights & Agreement Rules · Company practice
Korea: business analytics — remaining items processed
The remaining items of personal information processed for the business analytics purpose in the Korea appendix are IP addresses, session IDs, booking engine data, whether the person has a Hilton and American Express co-branded credit card, whether their Hilton and Amazon accounts are linked, whether their Hilton and Lyft accounts are linked, and spending amount.
Supporting quotations
IP addresses
Session IDs
Booking engine
Whether you have a Hilton and American Express Co-Branded Credit Card
Whether your Hilton and Amazon accounts are linked
Whether your Hilton and Lyft accounts are linked
Spending amount
Qualifications & exceptions
The items include spending amount and the partner account indicators.
Legal Rights & Agreement Rules · Company practice
Korea: eligibility for special or promotional rates — legal basis, sources and items processed
For the processing purpose of determining guests' eligibility for special or promotional rates, the Korea appendix states the legal basis as Article 15(1)(6) Legitimate Interest, the sources as directly from consumers, from third parties such as travel booking platforms and credit card providers, and from demographics companies, and the items of personal information processed as name, Hilton Honors number, corporate number and name, and travel agent number and name.
Supporting quotations
Determine guests' eligibility for special or promotional rates
Legal Basis
Article 15(1)(6) Legitimate Interest
Source
Directly from consumers
From third parties such as travel booking platforms and credit card providers
From demographics companies
Items of Personal Information Processed
Name
Hilton Honors number
Corporate number and name
Travel agent number and name
Qualifications & exceptions
The legal basis is legitimate interest under Article 15(1)(6) of the PIPA.
Legal Rights & Agreement Rules · Company practice
Korea: authenticating a mobile account — legal basis and source
For the processing purpose of authenticating a mobile account, the Korea appendix states the legal basis as Article 15(1)(6) Legitimate Interest and the source as directly from consumers. The remaining sources and the items processed are set out in the following part of the appendix.
Supporting quotations
Authenticate mobile account
Legal Basis
Article 15(1)(6) Legitimate Interest
Source
Directly from consumers
Qualifications & exceptions
Only the legal basis and the first source are stated in this part.
Legal Rights & Agreement Rules · Company practice
Korea: authenticating a mobile account — sources and items processed
The Korea appendix completes the entry for authenticating a mobile account: besides the source stated earlier — directly from consumers — a further source is third parties such as travel booking platforms and credit card providers, and the items of personal information processed are telephone and fax numbers and email address.
Supporting quotations
From third parties such as travel booking platforms and credit card providers
Items of Personal Information Processed
Telephone and fax numbers
Email address
Qualifications & exceptions
The legal basis for this purpose is legitimate interest under Article 15(1)(6) of the PIPA.
Legal Rights & Agreement Rules · Company practice
Korea: processing payments and strong customer authentication
For the processing purpose of processing payments, including conducting strong customer authentication where required by law, the Korea appendix states the legal basis as Article 15(1)4 of the PIPA, execution and performance of a contract; the sources as directly from consumers and from third parties such as travel booking platforms and credit card providers; and the items of personal information processed as name, home address, payment card information and IP addresses.
Supporting quotations
Process payments, including conducting strong customer authentication (SCA) when required by law
Legal Basis
Article 15(1)4 of the PIPA (Execution and Performance of a Contract)
Source
Directly from consumers
From third parties such as travel booking platforms and credit card providers
Items of Personal Information Processed
Name
Home address
Payment card information
IP addresses
Qualifications & exceptions
Strong customer authentication applies only where required by law.
The legal basis is contract performance under Article 15(1)4 of the PIPA.
Legal Rights & Agreement Rules · Company practice
Korea: processing transactions with partners
For the processing purpose of processing transactions with partners, the Korea appendix states the legal basis as Article 15(1)4 of the PIPA, execution and performance of a contract; the sources as directly from consumers and from third parties such as travel booking platforms and credit card providers; and the items of personal information processed as name, telephone and fax numbers, email address, home address and Hilton Honors number.
Supporting quotations
Process transactions with partners
Legal Basis
Article 15(1)4 of the PIPA (Execution and Performance of a Contract)
Source
Directly from consumers
From third parties such as travel booking platforms and credit card providers
Items of Personal Information Processed
Name
Telephone and fax numbers
Email address
Home address
Hilton Honors number
Qualifications & exceptions
The legal basis is contract performance under Article 15(1)4 of the PIPA.
Legal Rights & Agreement Rules · Company practice
Korea: optimizing the websites and mobile apps
For the processing purpose of optimizing Hilton's websites and mobile apps, the Korea appendix states the legal basis as Article 15(1)(6) Legitimate Interest, the sources as directly from consumers, from third parties such as travel booking platforms and credit card providers, and from demographics companies, and the items of personal information processed as name, internet or other electronic network activity information, and IP addresses.
Supporting quotations
Optimize our websites and mobile apps
Legal Basis
Article 15(1)(6) Legitimate Interest
Source
Directly from consumers
From third parties such as travel booking platforms and credit card providers
From demographics companies
Items of Personal Information Processed
Name
Internet or other electronic network activity information, including information regarding a customer's interaction with Hilton websites, applications, or advertisements
IP addresses
Qualifications & exceptions
The legal basis is legitimate interest under Article 15(1)(6) of the PIPA.
Legal Rights & Agreement Rules · Company practice
Korea: detecting and preventing fraud — legal basis, sources and first items
For the processing purpose of detecting and preventing fraud, the Korea appendix states the legal basis as Article 15(1)(6) Legitimate Interest, the sources as directly from consumers and from third parties such as travel booking platforms and credit card providers, and the items of personal information processed as name, telephone and fax numbers, email address, home address and payment card information. The remaining items for this purpose are listed in the following part of the appendix.
Supporting quotations
Detect and prevent fraud
Legal Basis
Article 15(1)(6) Legitimate Interest
Source
Directly from consumers
From third parties such as travel booking platforms and credit card providers
Items of Personal Information Processed
Name
Telephone and fax numbers
Email address
Qualifications & exceptions
The legal basis is legitimate interest under Article 15(1)(6) of the PIPA.
Legal Rights & Agreement Rules · Company practice
Korea: detecting and preventing fraud — remaining items processed
The remaining items of personal information processed for the fraud prevention purpose in the Korea appendix are home address, payment card information, Hilton Honors number, internet or other electronic network activity information, IP addresses, session IDs, geolocation information, and device information including MAC address.
Supporting quotations
Home address
Payment card information
Hilton Honors number
Internet or other electronic network activity information, including information regarding a customer's interaction with Hilton websites, applications, or advertisements
IP addresses
Session IDs
Geolocation information
Device information (including MAC address)
Qualifications & exceptions
The items combine identity, payment, device, location and online activity data.
Legal Rights & Agreement Rules · Company practice
Korea: SMS, service-related SMS and Hilton Honors communications
For the processing purpose of sending marketing communications via SMS, service-related SMS communications and communications relating to Hilton Honors — a single combined entry — the Korea appendix states the legal basis as Article 15(1)(1) (Consent) of the PIPA, the sources as directly from consumers, from third parties such as travel booking platforms and credit card providers, and from demographics companies, and the items of personal information processed as telephone and fax numbers and preferred language.
Supporting quotations
Send marketing communications via SMS, service-related SMS communications, and communications relating to Hilton Honors
Legal Basis
Article 15(1)(1) (Consent) of the PIPA)
Source
Directly from consumers
From third parties such as travel booking platforms and credit card providers
From demographics companies
Items of Personal Information Processed
Telephone and fax numbers
Preferred language
Qualifications & exceptions
Marketing, service-related and Honors communications are combined into one entry with a single legal basis.
The legal basis is consent under Article 15(1)(1) of the PIPA.
Legal Rights & Agreement Rules · Company practice
Korea: sales activity for group bookings, meetings and events
For the processing purpose of engaging in sales activity for group bookings, meetings and events, the Korea appendix states the legal basis as Article 15(1)(1) (Consent) of the PIPA, the sources as directly from consumers and from third parties such as travel booking platforms and credit card providers, and the items of personal information processed as telephone and fax numbers, email address and home address.
Supporting quotations
Engage in sales activity for group bookings, meetings and events
Legal Basis
Article 15(1)(1) (Consent) of the PIPA)
Source
Directly from consumers
From third parties such as travel booking platforms and credit card providers
Items of Personal Information Processed
Telephone and fax numbers
Email address
Home address
Qualifications & exceptions
The legal basis is consent under Article 15(1)(1) of the PIPA.
Legal Rights & Agreement Rules · Company practice
Korea: marketing communications via email
For the processing purpose of sending marketing communications via email, the Korea appendix states the legal basis as Article 15(1)(1) (Consent) of the PIPA, the sources as directly from consumers, from third parties such as travel booking platforms and credit card providers, and from demographics companies, and the item of personal information processed as email address.
Supporting quotations
Send marketing communications via email
Legal Basis
Article 15(1)(1) (Consent) of the PIPA)
Source
Directly from consumers
From third parties such as travel booking platforms and credit card providers
From demographics companies
Items of Personal Information Processed
Email address
Qualifications & exceptions
The legal basis is consent under Article 15(1)(1) of the PIPA.
Legal Rights & Agreement Rules · Company practice
Korea: marketing communications via direct mail
For the processing purpose of sending marketing communications via direct mail, the Korea appendix states the legal basis as Article 15(1)(1) (Consent) of the PIPA, the sources as directly from consumers, from third parties such as travel booking platforms and credit card providers, and from demographics companies, and the item of personal information processed as home address.
Supporting quotations
Send marketing communications via direct mail
Legal Basis
Article 15(1)(1) (Consent) of the PIPA)
Source
Directly from consumers
From third parties such as travel booking platforms and credit card providers
From demographics companies
Items of Personal Information Processed
Home address
Qualifications & exceptions
The legal basis is consent under Article 15(1)(1) of the PIPA.
Legal Rights & Agreement Rules · Company practice
Korea: books and records for legal obligations — legal basis and sources
For the processing purpose of maintaining books and records to comply with legal obligations for business reporting, auditing, tax and income reconciliation, the Korea appendix states the legal basis as Article 15(1)(6) Legitimate Interest and the sources as directly from consumers and from third parties such as travel booking platforms and credit card providers. The items of personal information processed are set out in the following part of the appendix.
Supporting quotations
Maintain books and records to comply with legal obligations for business reporting, auditing, tax, and income reconciliation
Legal Basis
Article 15(1)(6) Legitimate Interest
Source
Directly from consumers
From third parties such as travel booking platforms and credit card providers
Qualifications & exceptions
Only the legal basis and the sources are stated in this part.
Legal Rights & Agreement Rules · Company practice
Korea: books and records for legal obligations — items processed
The Korea appendix lists the items of personal information processed for the purpose of maintaining books and records to comply with legal obligations for business reporting, auditing, tax and income reconciliation as payment card information and spending amount, on the legal basis of legitimate interest under Article 15(1)(6) of the PIPA.
Supporting quotations
Items of Personal Information Processed
Payment card information
Spending amount
Qualifications & exceptions
The legal basis for this purpose is legitimate interest under Article 15(1)(6) of the PIPA.
Legal Rights & Agreement Rules · Company practice
Korea: enabling guests to log into the Hilton Honors account
For the processing purpose of enabling guests to log into their Hilton Honors account, the Korea appendix states the legal basis as Article 15(1)(1) (Consent) of the PIPA, the sources as directly from consumers, from third parties such as travel booking platforms and credit card providers, and from demographics companies, and the item of personal information processed as preferred language.
Supporting quotations
Enable guests to log into Hilton Honors Account
Legal Basis
Article 15(1)(1) (Consent) of the PIPA)
Source
Directly from consumers
From third parties such as travel booking platforms and credit card providers
From demographics companies
Items of Personal Information Processed
Preferred language
Qualifications & exceptions
The legal basis is consent under Article 15(1)(1) of the PIPA.
Legal Rights & Agreement Rules · Company practice
Korea: items processed for Hilton Honors account login
The Korea appendix's entry for enabling guests to log into their Hilton Honors account lists the items of personal information processed as preferred language, room preference, room selection and assignment, arrival time, departure date, MyWay preferences, email and consent preferences such as opt-out or opt-in, descriptions of incidents at a Hilton property or involving a Hilton employee including safety, security and violations of law, policy or contractual obligation, descriptions of complaints including free form textual feedback from Hilton Honors members, spa and wellness service or treatment details, and spending amount. The entry's legal basis is consent under Article 15(1)(1) of the PIPA and its sources are the consumer directly, booking platforms and card providers, and demographics companies.
Supporting quotations
Room preference
Room selection and assignment
Arrival time
Departure date
Your MyWay preferences
Your email and consent preferences (such as opt-out or opt-in, as applicable)
Description of an incident that occurs at a Hilton property or involves a Hilton employee, including incidents related to safety, security, violation of law, violation of applicable policy, or violation of contractual obligation
Description of a complaint that you make to us, including your free form textual feedback if you are a Hilton Honors member
Spa and wellness service or treatment details (such as date, time, and type of service)
Spending amount
Qualifications & exceptions
The item list is long and includes incident, complaint and spa or treatment details as well as preferences and spending amount.
The complaint description is included only where the person is a Hilton Honors member.
Legal Rights & Agreement Rules · Company practice
Korea: fulfilling and managing corporate travel reservations
For the processing purpose of fulfilling and managing corporate travel reservations, the Korea appendix states the legal basis as Article 15(1)4 of the PIPA, execution and performance of a contract; the sources as directly from consumers and from third parties such as travel booking platforms and credit card providers; and the item of personal information processed as corporate travel planner contact information, being the name, title, company, business phone, email and address.
Supporting quotations
Fulfill and manage corporate travel reservations
Legal Basis
Article 15(1)4 of the PIPA (Execution and Performance of a Contract)
Source
Directly from consumers
From third parties such as travel booking platforms and credit card providers
Items of Personal Information Processed
Corporate travel planner contact information (name, title, company, business phone, email and address)
Qualifications & exceptions
The legal basis is contract performance under Article 15(1)4 of the PIPA.
Legal Rights & Agreement Rules · Company practice
Korea: contacting members of the media and social media influencers
For the processing purpose of contacting members of the media and social media influencers in their business capacity, the Korea appendix states the legal basis as Article 15(1)(1) (Consent) of the PIPA, the sources as directly from consumers and from third parties such as travel booking platforms and credit card providers, and the item of personal information processed as travel agent number and name.
Supporting quotations
Contact members of the media and social media influencers in their business capacity
Legal Basis
Article 15(1)(1) (Consent) of the PIPA)
Source
Directly from consumers
From third parties such as travel booking platforms and credit card providers
Items of Personal Information Processed
Travel agent number and name
Qualifications & exceptions
The legal basis is consent under Article 15(1)(1) of the PIPA.
The item listed for this purpose is the travel agent number and name.
Legal Rights & Agreement Rules · Company practice
Korea: attributing points to airline loyalty participants
For the processing purpose of properly attributing points to consumers who participate in airline loyalty programs, the Korea appendix states the legal basis as Article 15(1)4 of the PIPA, execution and performance of a contract; the sources as directly from consumers and from third parties such as travel booking platforms and credit card providers; and the item of personal information processed as airline partner number and name.
Supporting quotations
Properly attribute points to consumers who participate in airline loyalty programs
Legal Basis
Article 15(1)4 of the PIPA (Execution and Performance of a Contract)
Source
Directly from consumers
From third parties such as travel booking platforms and credit card providers
Items of Personal Information Processed
Airline partner number and name
Qualifications & exceptions
The legal basis is contract performance under Article 15(1)4 of the PIPA.
Legal Rights & Agreement Rules · Company practice
Korea: enabling safety and security and guest parking
For the processing purpose of ensuring safety and security and enabling guests to park at Hilton's properties — a single combined entry — the Korea appendix states the legal basis as Article 15(1)(6) Legitimate Interest, the sources as directly from consumers and directly from cameras located on and around the property, and the item of personal information processed as vehicle information.
Supporting quotations
Ensure safety and security, and enable guests to park at our properties
Legal Basis
Article 15(1)(6) Legitimate Interest
Source
Directly from consumers
Directly from cameras located on and around the property
Items of Personal Information Processed
Vehicle information
Qualifications & exceptions
The entry combines two purposes, and one of its sources is on-property cameras.
The legal basis is legitimate interest under Article 15(1)(6) of the PIPA.
Legal Rights & Agreement Rules · Company practice
Korea: protecting guests, employees and visitors to properties
For the processing purpose of protecting guests, employees and visitors to Hilton's properties, the Korea appendix states the legal basis as Article 15(1)(6) Legitimate Interest, the source as directly from cameras located on and around the property, and the item of personal information processed as images or footage captured by closed circuit television.
Supporting quotations
Protect guests, employees and visitors to properties
Legal Basis
Article 15(1)(6) Legitimate Interest
Source
Directly from cameras located on and around the property
Items of Personal Information Processed
Images or footage captured by closed circuit television (CCTV)
Qualifications & exceptions
The only stated source is on-property cameras.
The legal basis is legitimate interest under Article 15(1)(6) of the PIPA.
Legal Rights & Agreement Rules · Company practice
Korea: internal and external promotions and communications
For the processing purpose of internal and external promotions and communications, the Korea appendix states the legal basis as Article 15(1)(1) (Consent) of the PIPA, the source as directly from cameras utilized on the property, and the item of personal information processed as promotional images or footage captured by on-property photographers.
Supporting quotations
Internal and external promotions and communications
Legal Basis
Article 15(1)(1) (Consent) of the PIPA)
Source
Directly from cameras utilized on the property
Items of Personal Information Processed
Promotional images or footage captured by on-property photographers
Qualifications & exceptions
The source is cameras used on the property, and the legal basis is consent.
The legal basis is consent under Article 15(1)(1) of the PIPA.
Legal Rights & Agreement Rules · Company practice
Korea: supporting marketing efforts
For the processing purpose of supporting marketing efforts, the Korea appendix states the legal basis as Article 15(1)(1) (Consent) of the PIPA, the sources as directly from consumers, indirectly from consumers by reviewing publicly available information on their social media channels, and from publicly available online sources, and the items of personal information processed as booking engine data, whether the person has a Hilton and American Express co-branded credit card, whether their Hilton and Amazon accounts are linked, whether their Hilton and Lyft accounts are linked, and spending amount.
Supporting quotations
Support marketing efforts
Legal Basis
Article 15(1)(1) (Consent) of the PIPA)
Source
Directly from consumers
Indirectly from consumers by reviewing publicly available information on their social media channels
From publicly available online sources
Items of Personal Information Processed
Booking engine
Whether you have a Hilton and American Express Co-Branded Credit Card
Whether your Hilton and Amazon accounts are linked
Whether your Hilton and Lyft accounts are linked
Spending amount
Qualifications & exceptions
Two of the three sources are public information, including the person's own social media channels.
The legal basis is consent under Article 15(1)(1) of the PIPA.
Legal Rights & Agreement Rules · Company practice
Korea: sharing data with advertising networks serving personalised advertisements
For the processing purpose of sharing data with advertising networks that serve personalised advertisements, the Korea appendix states the legal basis as Article 15(1)(1) (Consent) of the PIPA, the sources as directly from consumers, indirectly from consumers by reviewing publicly available information on their social media channels, and from publicly available online sources, and the items of personal information processed as internet or other electronic network activity information, IP addresses, session IDs, and device information including MAC address.
Supporting quotations
Share that data with advertising networks who serve personalized advertisements
Legal Basis
Article 15(1)(1) (Consent) of the PIPA)
Source
Directly from consumers
Indirectly from consumers by reviewing publicly available information on their social media channels
From publicly available online sources
Items of Personal Information Processed
Internet or other electronic network activity information, including information regarding a customer's interaction with Hilton websites, applications, or advertisements
IP addresses
Session IDs
Device information (including MAC address)
Qualifications & exceptions
Two of the three sources are public information, including the person's own social media channels.
The legal basis is consent under Article 15(1)(1) of the PIPA.
Legal Rights & Agreement Rules · Company practice
Korea: troubleshooting and resolving website issues
For the processing purpose of troubleshooting and resolving website issues, the Korea appendix states the legal basis as Article 15(1)(6) Legitimate Interest, the source as directly from consumers, and the items of personal information processed as IP addresses, customer ratings and survey responses, and free form textual feedback.
Supporting quotations
Troubleshoot and resolve website issues
Legal Basis
Article 15(1)(6) Legitimate Interest
Source
Directly from consumers
Items of Personal Information Processed
IP addresses
Customer ratings and survey responses
Free form textual feedback
Qualifications & exceptions
The legal basis is legitimate interest under Article 15(1)(6) of the PIPA.
Legal Rights & Agreement Rules · Company practice
Korea: showing targeted advertisements on media
For the processing purpose of showing targeted advertisements on media, the Korea appendix states the legal basis as Article 15(1)(1) (Consent) of the PIPA, the sources as directly from consumers, indirectly from consumers by reviewing publicly available information on their social media channels, and from publicly available online sources, and the item of personal information processed as booking engine data.
Supporting quotations
Show you targeted advertisements on media
Legal Basis
Article 15(1)(1) (Consent) of the PIPA)
Source
Directly from consumers
Indirectly from consumers by reviewing publicly available information on their social media channels
From publicly available online sources
Items of Personal Information Processed
Booking engine
Qualifications & exceptions
Two of the three sources are public information, including the person's own social media channels.
The legal basis is consent under Article 15(1)(1) of the PIPA.
Legal Rights & Agreement Rules · Company practice
Korea: items processed for showing targeted advertisements on media
The items of personal information processed for the purpose of showing targeted advertisements on media in the Korea appendix are booking engine data, whether the person has a Hilton and American Express co-branded credit card, whether their Hilton and Amazon accounts are linked, and whether their Hilton and Lyft accounts are linked. The legal basis for this purpose is consent under Article 15(1)(1) of the PIPA.
Supporting quotations
Whether you have a Hilton and American Express Co-Branded Credit Card
Whether your Hilton and Amazon accounts are linked
Whether your Hilton and Lyft accounts are linked
Qualifications & exceptions
The legal basis is consent under Article 15(1)(1) of the PIPA.
Legal Rights & Agreement Rules · Company practice
Korea: evaluating the usage of different streaming services
For the processing purpose of evaluating the usage of different streaming services, the Korea appendix states the legal basis as Article 15(1)(6) Legitimate Interest, the source as directly from the consumer as a result of logging into a streaming service through the Connected Room functionality, and the item of personal information processed as streaming service usage, including the service used, hours of use, launch method and log-out method.
Supporting quotations
Evaluate the usage of different streaming services
Legal Basis
Article 15(1)(6) Legitimate Interest
Source
Directly from consumer as a result of their logging into a streaming service through Connected Room functionality
Items of Personal Information Processed
Streaming service usage (including service used, hours of use, launch method, and log-out method)
Qualifications & exceptions
The data arises from logging into a streaming service through Connected Room.
The legal basis is legitimate interest under Article 15(1)(6) of the PIPA.
Legal Rights & Agreement Rules · Company practice
Korea: benefits associated with the co-branded card
For the processing purpose of providing benefits associated with the co-branded card, the Korea appendix states the legal basis as Article 15(1)4 of the PIPA, execution and performance of a contract; the source as American Express; and the item of personal information processed as whether the person has a Hilton and American Express co-branded credit card.
Supporting quotations
Provide you with benefits associated with your co-branded card
Legal Basis
Article 15(1)4 of the PIPA (Execution and Performance of a Contract)
Source
From American Express
Items of Personal Information Processed
Whether you have a Hilton and American Express Co-Branded Credit Card
Qualifications & exceptions
The source is the co-branded partner rather than the guest directly.
The legal basis is contract performance under Article 15(1)4 of the PIPA.
Legal Rights & Agreement Rules · Company practice
Korea: facilitating Honors points in Amazon's Shop with Points programme
For the processing purpose of facilitating the use of Honors points as part of Amazon's Shop with Points program, the Korea appendix states the legal basis as Article 15(1)4 of the PIPA, execution and performance of a contract; the source as Amazon; and the item of personal information processed as whether the person's Hilton and Amazon accounts are linked.
Supporting quotations
Facilitate use of Honors points as part of Amazon's Shop with Points program
Legal Basis
Article 15(1)4 of the PIPA (Execution and Performance of a Contract)
Source
From Amazon
Items of Personal Information Processed
Whether your Hilton and Amazon accounts are linked
Qualifications & exceptions
The source is the partner platform.
The legal basis is contract performance under Article 15(1)4 of the PIPA.
Legal Rights & Agreement Rules · Company practice
Korea: Digital Key sharing and guest access to room and facilities
For the processing purpose of fulfilling Digital Key sharing requests and enabling guest access to the guest room and hotel facilities — a single combined entry — the Korea appendix states the legal basis as Article 15(1)(1) (Consent) of the PIPA, the source as directly from consumers, and the item of personal information processed as geolocation information.
Supporting quotations
Fulfill Digital Key sharing requests, enable guest access to guest room and hotel facilities
Legal Basis
Article 15(1)(1) (Consent) of the PIPA)
Source
Directly from consumers
Items of Personal Information Processed
Geolocation information
Qualifications & exceptions
The legal basis is consent under Article 15(1)(1) of the PIPA.
Legal Rights & Agreement Rules · Company practice
Korea: a more personalized welcome and stay experience, and responding to service concerns
For the processing purpose of providing a more personalized welcome and stay experience and responding to service concerns in order to better serve guests — a single combined entry — the Korea appendix states two legal bases, Article 15(1)(6) Legitimate Interest and Article 15(1)(1) (Consent) of the PIPA; the sources as directly from consumers, indirectly from consumers by reviewing publicly available information on their social media channels, and from publicly available online sources; and the item of personal information processed as social media information and publicly available online information, including through social media platforms.
Supporting quotations
Provide a more personalized welcome and stay experience, respond to service concerns in order to better serve our guests
Legal Basis
Article 15(1)(6) Legitimate Interest
Article 15(1)(1) (Consent) of the PIPA)
Source
Directly from consumers
Indirectly from consumers by reviewing publicly available information on their social media channels
From publicly available online sources
Items of Personal Information Processed
Social media information; publicly available online information (including through social media platforms)
Qualifications & exceptions
This entry lists two legal bases, legitimate interest and consent.
Two of the three sources are public information, including the person's own social media channels.
Linking & Identification · Company practice
Korea: linking with customer information Hilton already has on file
For the processing purpose of linking with customer information Hilton already has on file, the Korea appendix states the legal basis as Article 15(1)(1) (Consent) of the PIPA, the sources as directly from consumers, indirectly from consumers by reviewing publicly available information on their social media channels, and from publicly available online sources, and the item of personal information processed as demographics data.
Supporting quotations
Link with customer information that Hilton already has on file
Legal Basis
Article 15(1)(1) (Consent) of the PIPA)
Source
Directly from consumers
Indirectly from consumers by reviewing publicly available information on their social media channels
From publicly available online sources
Items of Personal Information Processed
Demographics data
Qualifications & exceptions
The purpose is linkage with existing customer records, and the data used for it is demographics data.
Two of the three sources are public information.
Legal Rights & Agreement Rules · Company practice
Korea: sending the communications the guest would like to receive
For the processing purpose of sending the communications the guest would like to receive, the Korea appendix states the legal basis as Article 15(1)(1) (Consent) of the PIPA, the source as directly from consumers, and the item of personal information processed as the guest's MyWay preferences.
Supporting quotations
Send you the communications you would like to receive
Legal Basis
Article 15(1)(1) (Consent) of the PIPA)
Source
Directly from consumers
Items of Personal Information Processed
Your MyWay preferences
Qualifications & exceptions
The legal basis is consent under Article 15(1)(1) of the PIPA.
Legal Rights & Agreement Rules · Company practice
Korea without consent: eligibility for special or promotional rates
For the processing purpose of determining guests' eligibility for special or promotional rates, the Korea appendix states the legal basis as Article 15(1)(1) (Consent) of the PIPA, the source as directly from consumers, and the items of personal information processed as name, Hilton Honors number, corporate number and name, and travel agent number and name. The same item list appears in the Türkiye appendix for the same purpose, where the legal basis is legitimate interests.
Supporting quotations
Determine guests' eligibility for special or promotional rates
Legal Basis
Article 15(1)(1) (Consent) of the PIPA)
Source
Directly from consumers
Items of Personal Information Processed
Name
Hilton Honors number
Corporate number and name
Travel agent number and name
Qualifications & exceptions
The legal basis is consent under Article 15(1)(1) of the PIPA, in contrast to legitimate interest in the Türkiye appendix.
Legal Rights & Agreement Rules · Company practice
Korea: responding to safety and security concerns and complying with obligations
For the processing purpose of responding to safety and security concerns and complying with legal or contractual obligations — a single combined entry — the Korea appendix states the legal basis as Article 15(1)(6) Legitimate Interest, the source as directly from consumers, and the items of personal information processed as descriptions of incidents at a Hilton property or involving a Hilton employee, including safety, security, violation of law, violation of applicable policy or violation of contractual obligation, descriptions of complaints including free form textual feedback from Hilton Honors members, and spa and wellness service or treatment details.
Supporting quotations
Respond to safety and security concerns Comply with legal or contractual obligations
Legal Basis
Article 15(1)(6) Legitimate Interest
Source
Directly from consumers
Items of Personal Information Processed
Description of an incident that occurs at a Hilton property or involves a Hilton employee, including incidents related to safety, security, violation of law, violation of applicable policy, or violation of contractual obligation
Description of a complaint that you make to us, including your free form textual feedback if you are a Hilton Honors member
Spa and wellness service or treatment details (such as date, time, and type of service)
Qualifications & exceptions
The entry combines two purposes, and the complaint description is included only for Hilton Honors members.
Legal Rights & Agreement Rules · Context
Korea: the list of personal information processed without consent
The Korea appendix introduces a second list, of personal information Hilton processes without the consent of the data subject, following the list of processing carried out on consent. Each entry in this list gives the processing purpose, its legal basis, its sources and the items of personal information processed.
Supporting quotations
Personal information processed without the data subject’s consent. Hilton processes the following personal information without the consent of the data subject.
Qualifications & exceptions
This list covers processing carried out without the data subject's consent.
Legal Rights & Agreement Rules · Company practice
Korea: fulfilling guest reservations and verifying identity
For the processing purpose of fulfilling guest reservations and verifying identity — a single combined entry in the list processed without consent — the Korea appendix states the legal basis as Article 15(1)4 of the PIPA, execution and performance of a contract; the sources as directly from consumers and from third parties such as travel booking platforms and credit card providers; and the items of personal information processed as name, telephone and fax number, email address, home address and Hilton Honors number.
Supporting quotations
Fulfill guest reservations and verify identity
Legal Basis
Article 15(1)4 of the PIPA (Execution and Performance of a Contract)
Source
Directly from consumers
From third parties such as travel booking platforms and credit card providers
Items of Personal Information Processed
Name
Telephone and fax number
Email address
Home address
Hilton Honors number
Qualifications & exceptions
This entry appears in the list of processing carried out without consent, on the basis of contract performance.
The legal basis is contract performance under Article 15(1)4 of the PIPA.
Legal Rights & Agreement Rules · Company practice
Korea: sending guests communications relating to the reservation
For the processing purpose of sending guests communications relating to their reservation, the Korea appendix states the legal basis as Article 15(1)4 of the PIPA, execution and performance of a contract, and the sources as directly from consumers, from third parties such as travel booking platforms and credit card providers, and from demographics companies. The items of personal information processed for this purpose are listed in the following part of the appendix.
Supporting quotations
Send guests communications relating to their reservation
Legal Basis
Article 15(1)4 of the PIPA (Execution and Performance of a Contract)
Source
Directly from consumers
From third parties such as travel booking platforms and credit card providers
From demographics companies
Qualifications & exceptions
Only the legal basis and the sources are stated in this part.
The legal basis is contract performance under Article 15(1)4 of the PIPA.
Legal Rights & Agreement Rules · Company practice
Korea without consent: items processed for reservation communications
The items of personal information processed for the purpose of sending guests communications relating to their reservation, in the list of processing carried out without consent, are name, email address, home address and Hilton Honors number. The legal basis for that purpose is Article 15(1)4 of the PIPA, execution and performance of a contract.
Supporting quotations
Items of Personal Information Processed
Name
Email address
Home address
Hilton Honors number
Qualifications & exceptions
This entry is in the list processed without the data subject's consent, on the basis of contract performance.
Legal Rights & Agreement Rules · Company practice
Korea without consent: customer service and support — legal basis, sources and first items
For the processing purpose of providing customer service and support, in the list processed without consent, the Korea appendix states the legal basis as Article 15(1)4 of the PIPA, execution and performance of a contract; the sources as directly from consumers and from third parties such as travel booking platforms and credit card providers; and the items of personal information processed as name, telephone and fax numbers, email address, home address and Hilton Honors number.
Supporting quotations
Provide customer service and support
Legal Basis
Article 15(1)4 of the PIPA (Execution and Performance of a Contract)
Source
Directly from consumers
From third parties such as travel booking platforms and credit card providers
Items of Personal Information Processed
Name
Telephone and fax numbers
Email address
Home address
Qualifications & exceptions
The legal basis is contract performance under Article 15(1)4 of the PIPA.
Legal Rights & Agreement Rules · Company practice
Korea without consent: customer service — remaining items processed
The remaining items of personal information processed for the customer service and support purpose in the Korea appendix are Hilton Honors number, WeChat name and profile photo, arrival time, corporate travel planner contact information, booking engine data, whether the person has a Hilton and American Express co-branded credit card, whether their Hilton and Amazon accounts are linked, and whether their Hilton and Lyft accounts are linked.
Supporting quotations
Hilton Honors number
WeChat name and profile photo
Arrival time
Corporate travel planner contact information (name, title, company, business phone, email and address)
Booking engine
Whether you have a Hilton and American Express Co-Branded Credit Card
Whether your Hilton and Amazon accounts are linked
Whether your Hilton and Lyft accounts are linked
Qualifications & exceptions
The items include partner account indicators and corporate travel planner contact information.
Legal Rights & Agreement Rules · User right or choice
Korea: the rights of data subjects under the PIPA
The Korea appendix states that as residents of Korea, people are entitled to the following rights under the PIPA: the right to be informed, the right to access, the right to rectification, the right to erasure, the right to object, opt out of or suspend processing, the right to data portability, and the right to contest automated decision-making. The appendix lists the rights by name; the routes for exercising them follow in the next part.
Supporting quotations
2. Rights and Obligations of Data Subjects
As residents of Korea, you are entitled to the following rights under PIPA:
Right to be Informed
Right to Access
Right to Rectification
Right to Erasure
Right to Object/Opt-out or Suspend Processing
Right to Data Portability
Right to Contest Automated Decision-making
Qualifications & exceptions
The rights are listed by name; the detail of how to exercise them follows separately.
Legal Rights & Agreement Rules · Procedure
Korea: how to exercise the rights, and the Data Protection Office contacts
The Korea appendix says data subjects may at any time exercise their rights and should direct their requests to the named department using the contact information given, and that the Data Protection Office will respond promptly within the time period permitted by law. The department given is the Data Protection Office, with telephone number 070-4732-6767, the email address DataProtectionOffice@hilton.com, the address Attn: Data Protection Office, 7930 Jones Branch Drive, McLean, VA 22102, USA, and the Data Subject Rights Portal at datarights.hilton.com.
Supporting quotations
Exercise Your Rights: Data subjects may, at any time, exercise their rights and should direct their requests to the following department using the below contact information.
The Data Protection Office will respond promptly within the time period permitted by law.
Department: Data Protection Office
Telephone: 070-4732-6767
Email: DataProtectionOffice@hilton.com
Address: Attn: Data Protection Office, 7930 Jones Branch Drive, McLean, VA 22102, USA
The response is stated to be prompt and within the period permitted by law.
The stated department is the Data Protection Office, with a United States address.
Legal Rights & Agreement Rules · User right or choice
Korea: submitting a request on behalf of someone else
The Korea appendix states that in some circumstances a person may have the option to submit a request on behalf of someone else, and that if they do so they may be asked to provide proof of authorization.
Supporting quotations
In some circumstances you may have the option to submit a request on behalf of someone else.
If you submit a request on behalf of someone else, then you may be asked to provide proof of authorization.
Qualifications & exceptions
The option applies only 'in some circumstances'.
Proof of authorization may be requested.
Legal Rights & Agreement Rules · Procedure
Korea: remedies for infringement — dispute resolution and the reporting institutions
The Korea appendix says that to seek a remedy for personal information infringements, a person may apply for dispute resolution or consultation with institutions such as the Korea Internet & Security Agency's Personal Information Infringement Report Center, the Privacy Infringement Reporting Center, and gives the contact numbers for the Personal Information Dispute Mediation Committee, 1833-6972, the KISA Personal Information Infringement Report Center, 118, and the National Police Agency, 182.
Supporting quotations
Remedies for Infringement of Rights and Interests: To seek a remedy for personal information infringements, you may apply for dispute resolution or consultation with institutions such as the Korea Internet & Security Agency's (KISA) Personal Information Infringement Report Center, the Privacy Infringement Reporting Center.
Personal Information Dispute Mediation Committee: (without area code) 1833-6972
KISA Personal Information Infringement Report Center: (without area code) 118
National Police Agency: (without area code) 182
Qualifications & exceptions
Three Korean institutions are named with their own contact numbers.
The remedy route is offered in addition to the rights process.
Data Access & Collection · Company practice
Korea: cookies and other technologies used to provide personalized offers and content
The Korea appendix says Hilton's site may use cookies or other technologies — pixel tags, web beacons, clear GIFs, links in emails, JavaScript, device IDs assigned by Google or Apple or similar — to provide personalized offers and content, that cookies are small text files stored on the visitor's computer or mobile device when they visit a website, and refers the reader to the Online and Mobile Information We Collect section of the main body for more information.
Supporting quotations
3. Cookies and Other Technologies
Our site may use "Cookies" or "Other Technologies" (such as "pixel tags," "web beacons," "clear GIFs", links in emails, JavaScript, device IDs assigned by Google or Apple, or similar technologies) to provide personalized offers and content.
Cookies are small text files that are stored on your computer or mobile device when you visit a website.
Qualifications & exceptions
The stated purpose here is providing personalized offers and content.
The detail is in the main body rather than in the appendix.
Use & Processing · Company practice
Korea: behavioral information collected on consent and associated with a logged-in account
The Korea appendix states that if a person consents to the use of cookies and other technologies when interacting with Hilton's website or mobile application, Hilton will process and collect behavioral information related to those interactions, and that if the person consents and is logged into their Hilton Honors account, that behavioral information will be associated with the account. It says behavioral information is used to deliver personalized advertisements, optimize the website and mobile application, and support internal analysis, and is retained as necessary to fulfil the purpose for which it was collected or as required or permitted by law.
Supporting quotations
Behavioral Information: If you consent to the use of cookies and other technologies when you interact with our website or mobile application, Hilton will process and collect behavioral information related to such interactions.
If you consent and are logged into your Hilton Honors account, such behavioral information will be associated with your account.
Behavioral information is used to deliver personalized advertisements, optimize our website and mobile application, and support internal analysis.
Behavioral information is retained as necessary to fulfill the purpose for which it was collected or as required or permitted by law.
Qualifications & exceptions
Collection is conditional on consent to cookies and other technologies.
Association with the account requires both consent and being logged in.
Retention is tied to the collection purpose or to what the law requires or permits.
Account & Service Control · Context
Korea: instructions on allowing or blocking cookies are in the main body
The Korea appendix refers the reader to the section titled Managing Cookies and Other Technologies in the main body of the Statement for instructions on how to remove or block cookies from the device at any time. The appendix itself sets out no separate instructions.
Supporting quotations
Allowing/Blocking Cookies and Other Technologies: For instructions on how to remove or block Cookies from your device at any time, please refer to the section titled Managing Cookies and Other Technologies in the main body of this Statement.
Qualifications & exceptions
The instructions are in the main body rather than in the appendix.
Sharing & Disclosure · Company practice
Korea: transfer of personal information outside Korea to the United States with consent
The Korea appendix states that with the person's consent, Hilton will collect, process and transfer their personal information outside Korea to the United States, as necessary to fulfil their bookings and enable them to participate in the Hilton Honors programme. The transfer is stated as the destination being the United States and as requiring consent.
Supporting quotations
4. International Transfers of Personal Information
With your consent, we will collect, process, and transfer your personal information outside of Korea to the United States, as necessary to fulfill your bookings and enable you to participate in the Hilton Honors program.
Qualifications & exceptions
The transfer is stated to require the person's consent.
The stated purpose is fulfilling bookings and enabling participation in the loyalty programme.
Security & Safeguards · Company commitment
Korea: reasonable steps to protect personal information, with the detail in the main body
The Korea appendix states that Hilton takes reasonable steps to protect personal information from unauthorized access, disclosure, alteration or destruction, and to keep it appropriately accurate and current by using appropriate technical and organizational measures, and directs the reader to the How We Protect Information section of the main body for additional details.
Supporting quotations
5. How We Protect Personal Information
We take reasonable steps to: (i) protect personal information from unauthorized access, disclosure, alteration, or destruction, and (ii) keep personal information appropriately accurate and current by using appropriate technical and organizational measures.
For additional details, please refer to the How We Protect Information section in the main body of this Statement.
Qualifications & exceptions
The detail is in the main body rather than in the appendix.
Legal Rights & Agreement Rules · Company practice
Korea: when the policy takes effect and how to get the previous version
The Korea appendix says the Privacy Policy is effective from the last updated date shown at the top of the Statement, and that a person wanting the previous version should email privacy@hilton.com. It adds that for a summary of the material changes the reader should refer to the Changes to this Statement section.
Supporting quotations
6. Changes to the Privacy Policy
This Privacy Policy is effective from the last updated date noted at the top of this Statement.
For the previous version of this Statement, please email privacy@hilton.com
For a summary of the material changes, please refer to the Changes to this Statement section.
Qualifications & exceptions
Effectiveness is tied to the last updated date at the top of the Statement.
The previous version is available on request by email.
Sharing & Disclosure · Company practice
Mexico: personal information shared with Invex for telemarketing on the co-brand card
The Mexico appendix says that a person based in Mexico may have the following personal information shared with Invex, a third party that provides telemarketing services on behalf of the Hilton/Invex co-brand card: the Honors number, Honors loyalty tier, first name, last name, email address, phone number, co-brand card participation yes or no, last stay date and next stay date. It says a person may opt out of receiving telemarketing calls at any time by following the instructions in Invex's privacy statement, which is linked from the appendix and is not supplied in this source.
Supporting quotations
Appendix A-11: Mexico Residents
If you are based in Mexico, we may share the following personal information with Invex, a third party that provides telemarketing services on behalf of the Hilton/Invex co-brand credit card:
Honors Number
Honors Loyalty Tier
First Name
Last Name
Email Address
Phone Number
Co-Brand Card Participation (Y/N)
Last Stay Date
Next Stay Date
You may opt out of receiving telemarketing calls at any time by following the instructions provided in Invex’s privacy statement
Qualifications & exceptions
The sharing is to Invex, on behalf of the Hilton/Invex co-brand card, for telemarketing services.
The opt-out runs through Invex's own instructions, not through Hilton's Data Protection Office.
The co-brand card participation item is recorded as a yes or no.
Not stated here
The linked Invex privacy statement is not supplied in this source, so this card cannot say what it provides or requires.
Legal Rights & Agreement Rules · Context
Albania: additional information for residents, with an Albanian translation of the Statement
The Albania appendix states that it provides additional information for individuals residing in Albania, and that the Albanian translation of the Global Privacy Statement is available through the link in the appendix. The Albanian text itself is a separate document that this source does not contain.
Supporting quotations
Appendix A-12: Albania Residents
This Appendix provides additional information for individuals residing in Albania.
The Albanian translation of the Global Privacy Statement is available
Qualifications & exceptions
The Albanian translation is a separate document, linked from the appendix and not supplied here.
Not stated here
The linked Albanian translation of the Global Privacy Statement is not supplied in this source, so this card cannot say what the Albanian text provides.
Data Access & Collection · Context
Appendix B: Hilton Premium Club Japan programme information
The Appendix B says that if a person is a member of Hilton Premium Club Japan, including Hilton Dining Plus, the information that follows applies to the processing of their personal information in addition to the information disclosed in the rest of the Statement. It then introduces the categories of personal information collected in the past 12 months. The appendix is therefore an addition to the main disclosure, not a replacement.
Supporting quotations
Appendix B: Hilton Premium Club Japan Program
If you are a member of Hilton Premium Club Japan (HPCJ), including Hilton Dining Plus, the following information applies to the processing of your personal information in addition to the information disclosed in the remainder of this Statement.
We have collected the following categories of personal information in the past 12 months:
Qualifications & exceptions
The appendix applies in addition to the rest of the Statement.
The categories are those collected in the past 12 months.
The programme covered is Hilton Premium Club Japan, including Hilton Dining Plus.
Data Access & Collection · Company practice
HPCJ: member number — source and first business purposes
In the Appendix B list, the HPCJ member number is obtained directly from members themselves and collected for the additional business or commercial purposes of fulfilling guest reservations, sending guests communications about their reservations, administering membership and activity in the Hilton Premium Club Japan loyalty programme, providing customer service and support, verifying identity, sending marketing communications by email, direct mail and social media, and performing analytics to provide guests with personalized offers and content. The further purposes are set out in the next part of the appendix.
Supporting quotations
HPCJ member number
We have obtained this personal information from the following sources:
Directly from members themselves
We collected this personal information for the following additional business or commercial purposes:
Fulfill guest reservations
Send guests communications relating to their reservations
Administer membership and activity in the Hilton Premium Club Japan Program loyalty program
Provide customer service and support
Verify identity
Send marketing communications via email, direct mail, and social media
Perform analytics in order to provide guests with personalized offers and content
Qualifications & exceptions
The purposes are stated as additional to the purposes in the rest of the Statement.
Only the first purposes of this category are stated in this part.
Data Access & Collection · Company practice
HPCJ: member number — remaining business purposes
The remaining stated purposes for the HPCJ member number are performing analytics to improve business operations, determining guests' eligibility for special or promotional rates, processing payments including strong customer authentication where required by law, processing transactions with partners, administering contests and sweepstakes, and detecting and preventing fraud.
Supporting quotations
Perform analytics to improve business operations
Determine guests' eligibility for special or promotional rates
Process payments including conducting strong customer authentication (SCA) when required by law
Process transactions with partners
Administer contests and sweepstakes
Detect and prevent fraud
Qualifications & exceptions
Strong customer authentication applies only where required by law.
Sharing & Disclosure · Company practice
HPCJ: member number — additional third parties shared with
The Appendix B states that the HPCJ member number is shared with the following additional categories of third parties: payment card issuers and payment processors; Hilton's Third-Party Partner; service providers who perform tasks on behalf of Hilton, which may include those who send marketing communications on Hilton's behalf; employers pursuant to corporate agreements, employee consent and as permitted by law; entities that have arranged a special rate plan with Hilton and/or organized an event or room block with Hilton; government agencies pursuant to legal requirements in some countries; third-party advertisers, for optimization and personalization on their platforms; and Hilton's Third-Party Operator.
Supporting quotations
We have shared this personal information with the following additional categories of third parties
Payment card issuers and payment processors
Hilton's Third-Party Partner
Service providers who perform tasks on behalf of Hilton, which may include those who send marketing communications on our behalf
Employers pursuant to corporate agreements, employee consent, and as permitted by law
Entities that have arranged a special rate plan with Hilton and/or organized an event and/or room block with Hilton
Government agencies pursuant to legal requirements in some countries
Third-party advertisers, for optimization and personalization on their platforms
Hilton’s Third-Party Operator
Qualifications & exceptions
The sharing is stated as additional to the sharing described in the rest of the Statement.
Employer and government sharing are qualified by corporate agreements, employee consent, the law and 'some countries'.
Data Access & Collection · Company practice
HPCJ: name — source, purposes and no additional sharing
In the Appendix B list, the name is obtained directly from consumers themselves and collected for the additional business or commercial purposes of administering membership and activity in the Hilton Premium Club Japan loyalty programme and conducting telephone calls to inquire about new memberships. The appendix states that the name is not shared with any additional third parties.
Supporting quotations
Name
We have obtained this personal information from the following sources:
Directly from consumers themselves
We collected this personal information for the following additional business or commercial purposes:
Administer membership and activity in the Hilton Premium Club Japan Program loyalty program
Conduct telephone calls to inquire about new memberships
We have shared this personal information with the following additional categories of third parties
We do not share name with any additional third parties.
Qualifications & exceptions
The sharing statement is limited to additional third parties, that is, to the recipients beyond those described in the rest of the Statement.
One stated purpose is soliciting new memberships by telephone.
Data Access & Collection · Company practice
HPCJ: telephone and fax numbers — source, purposes and sharing
In the Appendix B list, telephone and fax numbers are obtained directly from consumers themselves and collected for the additional business or commercial purposes of administering membership and activity in the Hilton Premium Club Japan loyalty programme, conducting telephone calls to inquire about new memberships, and processing payments including strong customer authentication where required by law. The information is shared with payment card issuers and payment processors as an additional category of third parties.
Supporting quotations
Telephone and fax numbers
We have obtained this personal information from the following sources:
Directly from consumers themselves
We collected this personal information for the following additional business or commercial purposes:
Administer membership and activity in the Hilton Premium Club Japan Program loyalty program
Conduct telephone calls to inquire about new memberships
Process payments, including conducting strong customer authentication (SCA) when required by law
We have shared this personal information with the following additional categories of third parties
Payment card issuers and payment processors
Qualifications & exceptions
Strong customer authentication applies only where required by law.
The sharing is stated as additional to the sharing described in the rest of the Statement.
Data Access & Collection · Company practice
HPCJ: email address — source and first additional purposes
In the Appendix B list, the email address is obtained directly from consumers themselves and collected for the additional business or commercial purposes of administering membership and activity in the Hilton Premium Club Japan loyalty programme. The remaining purposes for this category are set out in the next part of the appendix.
Supporting quotations
Email address
We have obtained this personal information from the following sources:
Directly from consumers themselves
We collected this personal information for the following additional business or commercial purposes:
Administer membership and activity in the Hilton Premium Club Japan Program loyalty program
Qualifications & exceptions
Only the first purpose of this category is stated in this part.
Data Access & Collection · Company practice
HPCJ: email address — remaining purposes and sharing
The remaining stated purposes for the email address in the Appendix B list are authenticating the Hilton Premium Club Japan Programme account and processing payments including strong customer authentication where required by law, and the information is shared with payment card issuers and payment processors as an additional category of third parties.
Supporting quotations
Authenticate Hilton Premium Club Japan Program account
Process payments, including conducting strong customer authentication (SCA) when required by law
We have shared this personal information with the following additional categories of third parties
Payment card issuers and payment processors
Qualifications & exceptions
Strong customer authentication applies only where required by law.
The sharing is stated as additional to the sharing described in the rest of the Statement.
Data Access & Collection · Company practice
HPCJ: home address — source, purpose and no additional sharing
In the Appendix B list, the home address is obtained directly from consumers themselves and collected for the additional business or commercial purpose of administering membership and activity in the Hilton Premium Club Japan loyalty programme. The appendix states that the home address is not shared with any additional third parties.
Supporting quotations
Home address
We have obtained this personal information from the following sources:
Directly from consumers themselves
We collected this personal information for the following additional business or commercial purposes:
Administer membership and activity in the Hilton Premium Club Japan Program loyalty program
We have shared this personal information with the following additional categories of third parties
We do not share home address with any additional third parties.
Qualifications & exceptions
The sharing statement is limited to additional third parties.
Data Access & Collection · Company practice
HPCJ: date of birth — source, purposes and sharing
In the Appendix B list, the date of birth is obtained directly from customers themselves and collected for the additional business or commercial purposes of administering membership and activity in the Hilton Premium Club Japan loyalty programme, providing customer service and support, verifying identity, sending marketing communications by email, direct mail and social media, performing analytics to provide guests with personalized offers and content, performing analytics to improve business operations, and processing payments including strong customer authentication where required by law. The information is shared with payment card issuers and payment processors and with Hilton's Third-Party Partner as additional categories of third parties.
Supporting quotations
Date of birth
We have obtained this personal information from the following sources:
Directly from customers themselves
We collected this personal information for the following additional business or commercial purposes:
Administer membership and activity in the Hilton Premium Club Japan Program loyalty program
Provide customer service and support
Verify identity
Send marketing communications via email, direct mail, and social media
Perform analytics in order to provide guests with personalized offers and content
Perform analytics to improve business operations
Process payments including conducting strong customer authentication (SCA) when required by law
We have shared this personal information with the following additional categories of third parties
Payment card issuers and payment processors
Hilton's Third-Party Partner
Qualifications & exceptions
Strong customer authentication applies only where required by law.
The sharing is stated as additional to the sharing described in the rest of the Statement.
Data Access & Collection · Company practice
HPCJ: gender — source, purposes and sharing
In the Appendix B list, gender is obtained directly from members themselves and collected for the additional business or commercial purposes of administering membership and activity in the Hilton Premium Club Japan loyalty programme, providing customer service and support, performing analytics to provide guests with personalized offers and content, and performing analytics to improve business operations. The information is shared with Hilton's Third-Party Partner as an additional category of third parties.
Supporting quotations
Gender
We have obtained this personal information from the following sources:
Directly from members themselves
We collected this personal information for the following additional business or commercial purposes:
Administer membership and activity in the Hilton Premium Club Japan Program loyalty program
Provide customer service and support
Perform analytics in order to provide guests with personalized offers and content
Perform analytics to improve business operations
We have shared this personal information with the following additional categories of third parties
Hilton's Third-Party Partner
Qualifications & exceptions
The sharing is stated as additional to the sharing described in the rest of the Statement.
Data Access & Collection · Company practice
HPCJ: payment card information — source, purpose and no additional sharing
In the Appendix B list, payment card information is obtained directly from consumers themselves and collected for the additional business or commercial purpose of administering membership and activity in the Hilton Premium Club Japan loyalty programme. The appendix states that payment card information is not shared with any additional third parties.
Supporting quotations
Payment card information
We have obtained this personal information from the following sources:
Directly from consumers themselves
We collected this personal information for the following additional business or commercial purposes:
Administer membership and activity in the Hilton Premium Club Japan Program loyalty program
We have shared this personal information with the following additional categories of third parties
We do not share payment card information with any additional third parties.
Qualifications & exceptions
The sharing statement is limited to additional third parties.
Data Access & Collection · Company practice
HPCJ: Hilton Honors number — source, purpose and no additional sharing
In the Appendix B list, the Hilton Honors number is obtained directly from Hilton Honors members themselves and collected for the additional business or commercial purpose of administering membership and activity in the Hilton Premium Club Japan loyalty programme. The appendix states that the Hilton Honors number is not shared with any additional third parties.
Supporting quotations
Hilton Honors number
We have obtained this personal information from the following sources:
Directly from Hilton Honors members themselves
We collected this personal information for the following additional business or commercial purposes:
Administer membership and activity in the Hilton Premium Club Japan Program loyalty program
We have shared this personal information with the following additional categories of third parties
We do not share Hilton Honors number with any additional third parties.
Qualifications & exceptions
The sharing statement is limited to additional third parties.
Data Access & Collection · Company practice
HPCJ: device information — source, SCA purpose and sharing
In the Appendix B list, device information including MAC address is obtained directly from consumers as a result of their browsing activity on the internet or scanning QR codes on property, and collected for the additional business or commercial purpose of conducting strong customer authentication as part of the payment process when required by law. It is shared with payment card issuers and payment processors, but only when conducting strong customer authentication.
Supporting quotations
Device information (including MAC address)
We have obtained this personal information from the following sources:
Directly from consumers as a result of their browsing activity on the internet or scanning or QR codes on property
We collected this personal information for the following additional business or commercial purposes:
Conduct SCA as part of the payment process, when required by law
We have shared this personal information with the following additional categories of third parties
Payment card issuers and payment processors when conducting SCA
Qualifications & exceptions
The source is browsing activity or scanning QR codes on property.
Both the purpose and the sharing are limited to the strong customer authentication case.
Data Access & Collection · Company practice
HPCJ: company information — source, purposes and sharing
In the Appendix B list, company information including department and title is obtained directly from members themselves and collected for the additional business or commercial purposes of administering membership and activity in the Hilton Premium Club Japan loyalty programme, providing customer service and support, performing analytics to provide guests with personalized offers and content, and performing analytics to improve business operations. The information is shared with Hilton's Third-Party Partner as an additional category of third parties.
Supporting quotations
Company information (including department and title)
We have obtained this personal information from the following sources:
Directly from members themselves
We collected this personal information for the following additional business or commercial purposes:
Administer membership and activity in the Hilton Premium Club Japan Program loyalty program
Provide customer service and support
Perform analytics in order to provide guests with personalized offers and content
Perform analytics to improve business operations
We have shared this personal information with the following additional categories of third parties
Hilton's Third-Party Partner
Qualifications & exceptions
The sharing is stated as additional to the sharing described in the rest of the Statement.