Global Privacy Statement

Data Access & Collection · Restriction or exception

The Statement does not cover Hilton's processing for other companies

The Statement states that it does not apply to Hilton's processing of personal information on behalf of, and subject to the instructions of, third parties such as airlines, car rental companies and other service providers, companies that organize or offer packaged travel arrangements, marketing partners, or certain corporate customers. Where Hilton acts only as someone else's processor, the person's data is governed by that other company's own notice rather than by this text.

Supporting quotations

Please note that this Statement does not apply to our processing of personal information on behalf of and subject to the instructions of third parties such as airlines, car rental companies and other service providers, companies that organize or offer packaged travel arrangements, marketing partners, or certain corporate customers.

Qualifications & exceptions

• The exclusion is limited to processing done on another party's instructions; Hilton's own collection and use remain covered.
• The list of excluded controllers is given by example, not exhaustively.

Data Access & Collection · Company practice

What the collection summary covers, the required-information limit, and the consent promise

Hilton introduces the collection summary by saying it covers the categories of personal information collected in the past 12 months, the sources of each category, the business or commercial purposes for collection, the categories of third parties the information may have been shared with as permitted by law, and whether it was sold to a third party for a business or commercial purpose in that period. It adds two limits: some categories are required in order to provide the requested products or services, so declining to give them may mean Hilton cannot provide those services; and where consent is required, Hilton will obtain explicit, informed consent before collecting, processing, selling or sharing.

Supporting quotations

The following summarizes the categories of personal information we have collected in the past 12 months, the sources for those categories of personal information, the business or commercial purposes for which the information was collected, the categories of third parties with whom the information may have been shared, as permitted by law, and whether the information was sold to a third party for a business or commercial purpose within the past 12 months.

Certain categories of personal information collected are required in order for us to provide you with the requested products or services, and if you choose not to provide us with such information, we may not be able to provide you with these products or services.

If consent is required, we will obtain your explicit, informed consent before collecting, processing, selling, or sharing your personal information.

For additional information on how we share personal information, please refer to the How We Disclose Personal Information section.

Qualifications & exceptions

• The summary reports a 12-month look-back, so it is a retrospective disclosure rather than a complete description of every category Hilton may hold.
• Refusal of required categories limits service delivery, not the rest of the relationship.
• The consent promise is conditional on consent being required in the applicable jurisdiction.

Data Access & Collection · Company practice

Name: collected from the guest, from booking platforms and credit card providers, and from demographics companies

For the 'Name' category, Hilton states that it obtained the information from three sources: directly from consumers themselves; from third parties such as travel booking platforms and credit card providers; and from demographics companies. It then lists the business or commercial purposes for which the name was collected, beginning with fulfilling guest reservations; the rest of the listed purposes, and the third-party sharing and sale status for this category, are set out in the following part of the collection summary.

Supporting quotations

Name

We have obtained this personal information from the following sources:

Directly from consumers themselves

From third parties such as travel booking platforms and credit card providers

From demographics companies

We collected this personal information for the following business or commercial purposes:

Fulfill guest reservations

Qualifications & exceptions

• The statement reports what was collected in the 12 months before August 31, 2026, not a guarantee about future collection.
• Enrichment from demographics companies is described as a source of the name, without stating what that enrichment contains.

Data Access & Collection · Company practice

Telephone and fax numbers: sources and business purposes

For telephone and fax numbers, Hilton says it obtained the information directly from consumers themselves, from third parties such as travel booking platforms and credit card providers, and from demographics companies. The business or commercial purposes it lists for collecting telephone and fax numbers are: fulfilling guest reservations; sending guests communications about their reservations; providing customer service and support; verifying identity; sending marketing communications by SMS; processing transactions with partners; authenticating a mobile account; sending service-related SMS communications; detecting and preventing fraud; engaging in sales activity for group bookings, meetings and events; and sending post-stay surveys by SMS.

Supporting quotations

Telephone and fax numbers

We have obtained this personal information from the following sources:

Directly from consumers themselves

From third parties such as travel booking platforms and credit card providers

From demographics companies

We collected this personal information for the following business or commercial purposes:

Fulfill guest reservations

Send guests communications relating to their reservations

Provide customer service and support

Verify identity

Send marketing communications via SMS

Process transactions with partners

Authenticate mobile account

Sending service-related SMS communications

Detect and prevent fraud

Engage in sales activity for group bookings, meetings and events

Qualifications & exceptions

• The stated collection window is the 12 months before August 31, 2026.
• SMS marketing and post-stay surveys by SMS are stated purposes here; the Statement's marketing choices section governs how they can be stopped.
• The French appendix states that the phone number is not used for telemarketing, which is a France-specific rule and not the rule of this main body.

Data Access & Collection · Company practice

Email address: sources and business purposes

For email addresses, Hilton says it obtained the information directly from consumers themselves, from third parties such as travel booking platforms and credit card providers, and from demographics companies. The purposes it lists are: fulfilling guest reservations; sending guests communications about their reservations; administering membership and activity in the Hilton Honors loyalty program; providing customer service and support; verifying identity; sending marketing communications by email; processing transactions with partners; administering contests and sweepstakes; authenticating a mobile account; detecting and preventing fraud; and engaging in sales activity for group bookings, meetings and events.

Supporting quotations

Email address

We have obtained this personal information from the following sources:

Directly from consumers themselves

From third parties such as travel booking platforms and credit card providers

From demographics companies

We collected this personal information for the following business or commercial purposes:

Fulfill guest reservations

Send guests communications relating to their reservations

Administer membership and activity in the Hilton Honors loyalty program

Provide customer service and support

Verify identity

Send marketing communications via email

Process transactions with partners

Administer contests and sweepstakes

Authenticate mobile account

Detect and prevent fraud

Qualifications & exceptions

• The stated collection window is the 12 months before August 31, 2026.
• Email marketing is listed as a purpose here, subject to the marketing choices and unsubscribe rights the Statement describes.
• The source list shows the email address can be obtained indirectly from booking platforms, card providers and demographics companies.

Data Access & Collection · Company practice

Home address: obtained directly from consumers

For home address, the collection summary opens by naming its sources: Hilton obtained the information directly from consumers themselves, and lists further sources and purposes for the same category further on. A home address is therefore collected from the guest as a primary source, with the remaining sources, the business purposes and the third-party sharing for this category stated in the following part of the summary.

Supporting quotations

Home address

We have obtained this personal information from the following sources:

Directly from consumers themselves

Qualifications & exceptions

• Only the first source of this category is stated in this part; the rest of the category is set out in the next part of the summary.
• The category is 'Home address' as such; a separate 'Address' category with its own sources, purposes and sharing appears in the point-of-collection section.

Data Access & Collection · Company practice

Home address: further sources — booking platforms, card providers and demographics companies

Beyond the guest directly, Hilton says it obtained the home address from third parties such as travel booking platforms and credit card providers, and from demographics companies. The address can therefore be collected indirectly from booking and payment channels and enriched from demographic data providers, not only typed in by the guest.

Supporting quotations

From third parties such as travel booking platforms and credit card providers

From demographics companies

Qualifications & exceptions

• The stated collection window is the 12 months before August 31, 2026.
• The Statement does not say which fields are received from these sources.

Data Access & Collection · Company practice

Nationality: collected from the guest for legal compliance, shared with government agencies, not sold

For nationality, Hilton says it obtained the information directly from consumers themselves and collected it to comply with applicable laws that require the collection of this information in some jurisdictions. It says it shared nationality with government agencies pursuant to legal requirements in some countries, and that the information was not sold to a third party within the past 12 months. The legal-trigger wording is global and qualified: the Statement does not tie the collection or the government sharing to United States law only.

Supporting quotations

Nationality

We have obtained this personal information from the following sources:

Directly from consumers themselves

We collected this personal information for the following business or commercial purposes:

Comply with applicable laws that require us to collect this information in some jurisdictions

We have shared this personal information with the following categories of third parties

Government agencies pursuant to legal requirements in some countries

This information was sold to a third party within the past 12 months

No

Qualifications & exceptions

• Collection and government sharing are tied to laws and requirements 'in some jurisdictions' and 'in some countries', not to any one country.
• The sale answer covers the 12 months before August 31, 2026.

Data Access & Collection · Company practice

Date of birth: collected from the guest for legal compliance, shared with government agencies, not sold

For date of birth, Hilton says it obtained the information directly from consumers themselves and collected it to comply with applicable laws that require the collection of this information in some jurisdictions. It says it shared the date of birth with government agencies pursuant to legal requirements in some countries, and that this information was not sold to a third party within the past 12 months.

Supporting quotations

Date of birth

We have obtained this personal information from the following sources:

Directly from consumers themselves

We collected this personal information for the following business or commercial purposes:

Comply with applicable laws that require us to collect this information in some jurisdictions

We have shared this personal information with the following categories of third parties

Government agencies pursuant to legal requirements in some countries

This information was sold to a third party within the past 12 months

No

Qualifications & exceptions

• Collection and government sharing are qualified to laws and requirements 'in some jurisdictions' and 'in some countries'.
• The sale answer covers the 12 months before August 31, 2026.

Data Access & Collection · Company practice

Gender: collected from the guest for legal compliance, shared with government agencies, not sold

For gender, Hilton says it obtained the information directly from consumers themselves and collected it to comply with applicable laws that require the collection of this information in some jurisdictions. It says it shared gender with government agencies pursuant to legal requirements in some countries, and that this information was not sold to a third party within the past 12 months. The Statement does not describe gender as used for personalization here; the stated purpose is legal compliance.

Supporting quotations

Gender

We have obtained this personal information from the following sources:

Directly from consumers themselves

We collected this personal information for the following business or commercial purposes:

Comply with applicable laws that require us to collect this information in some jurisdictions

We have shared this personal information with the following categories of third parties

Government agencies pursuant to legal requirements in some countries

This information was sold to a third party within the past 12 months

No

Qualifications & exceptions

• Collection and government sharing are qualified to laws and requirements 'in some jurisdictions' and 'in some countries'.
• The sale answer covers the 12 months before August 31, 2026.

Data Access & Collection · Company practice

Payment card information: sources, payment and record-keeping purposes, recipients, not sold

For payment card information, Hilton says it obtained the information directly from consumers themselves and from the third-party travel booking platform or travel agent through which a consumer made a reservation. The stated purposes are processing payments, including strong customer authentication where the law requires it, detecting and preventing fraud, and maintaining books and records to comply with legal obligations for business reporting, auditing, tax and income reconciliation. It says it shared card information with payment card issuers and payment processors, with Hilton's Partner Accommodations, with Hilton's Third-Party Operator and with Hilton Principal, and that the information was not sold to a third party within the past 12 months.

Supporting quotations

Payment card information

We have obtained this personal information from the following sources:

Directly from consumers themselves

The third-party travel booking platform or travel agent through which a consumer made a reservation

We collected this personal information for the following business or commercial purposes:

Process payments, including conducting SCA when required by law

Detect and prevent fraud

Maintain books and records to comply with legal obligations for business reporting, auditing, tax, and income reconciliation

We have shared this personal information with the following categories of third parties

Payment card issuers and payment processors

Hilton's Partner Accommodations

Hilton's Third-Party Operator

Hilton Principal

This information was sold to a third party within the past 12 months

No

Qualifications & exceptions

• Strong customer authentication is stated to apply only 'when required by law'.
• The record-keeping purpose is tied to legal obligations for business reporting, auditing, tax and income reconciliation.
• The sale answer covers the 12 months before August 31, 2026.

Data Access & Collection · Company practice

Hilton Honors number: obtained from members, used for reservations, service, verification and marketing

For the Hilton Honors number, Hilton says it obtained the information directly from Hilton Honors members themselves. The business or commercial purposes it lists are fulfilling guest reservations, sending guests communications about their reservations, administering membership and activity in the loyalty program, providing customer service and support, verifying the account, sending marketing communications by email, direct mail and social media, and performing analytics that provide guests with personalized offers and content and analytics that improve business operations.

Supporting quotations

Hilton Honors number

We have obtained this personal information from the following sources:

Directly from Hilton Honors members themselves

We collected this personal information for the following business or commercial purposes:

Fulfill guest reservations

Send guests communications relating to their reservations

Administer membership and activity in the Hilton Honors loyalty program

Provide customer service and support

Verify account

Send marketing communications via email, direct mail, and social media

Perform analytics in order to provide guests with personalized offers and content

Perform analytics to improve business operations

Qualifications & exceptions

• The stated collection window is the 12 months before August 31, 2026.
• This is the loyalty-programme identifier, distinct from the booking confirmation number used by travel agents and airline partners.

Data Access & Collection · Company practice

Departure date: obtained from the guest, used for service and reservations, shared with partner hotels

For departure date, Hilton says it obtained the information directly from consumers themselves. The purposes it lists are better serving guests, fulfilling reservations and personalizing the guest experience. It says it shared the departure date with Hilton Partner Accommodations, with Hilton's Third-Party Operator and with Hilton Principal, and that the information was not sold to a third party within the past 12 months.

Supporting quotations

Departure date

We have obtained this personal information from the following sources:

Directly from consumers themselves

We collected this personal information for the following business or commercial purposes:

Better serve our guests

Fulfill reservations

Personalize guest experience

We have shared this personal information with the following categories of third parties

Hilton Partner Accommodations

Hilton's Third-Party Operator

Hilton Principal

This information was sold to a third party within the past 12 months

No

Qualifications & exceptions

• The stated collection window is the 12 months before August 31, 2026.
• Recipients are categories of third party rather than named companies.

Data Access & Collection · Company practice

Additional guest names: collected from the guest for reservations, shared with partners, sold

For additional guest names, Hilton says it obtained the information directly from consumers themselves and collected it to fulfill reservations. It says it shared the names with Hilton's Third-Party Partner, with Hilton Partner Accommodations and with Hilton's Third-Party Operator, and that the information was sold to a third party within the past 12 months.

Supporting quotations

Additional guest names

We have obtained this personal information from the following sources:

Directly from consumers themselves

We collected this personal information for the following business or commercial purposes:

Fulfill reservations

We have shared this personal information with the following categories of third parties

Hilton's Third-Party Partner

Hilton Partner Accommodations

Hilton's Third-Party Operator

This information was sold to a third party within the past 12 months

Yes

Qualifications & exceptions

• The sale answer covers the 12 months before August 31, 2026.
• The names are those of other people the guest supplies, so the collection concerns other individuals' information as well as the guest's.

Data Access & Collection · Company practice

Corporate travel planner information: from corporate contacts, shared with employers, not sold

For corporate travel planner information, Hilton says it obtained the information directly from the corporate contacts themselves. The purposes it lists are fulfilling and managing corporate travel reservations, providing customer service and support, and sending marketing communications by email, direct mail and social media. It says it shared the information with employers pursuant to corporate agreements, employee consent and as permitted by law, and that the information was not sold to a third party within the past 12 months.

Supporting quotations

Corporate travel planner information

We have obtained this personal information from the following sources:

Directly from the corporate contacts themselves

We collected this personal information for the following business or commercial purposes:

Fulfill and manage corporate travel reservations

Provide customer service and support

Send marketing communications via email, direct mail, and social media

We have shared this personal information with the following categories of third parties

Employers pursuant to corporate agreements, employee consent, and as permitted by law

This information was sold to a third party within the past 12 months

No

Qualifications & exceptions

• The source here is the corporate contact, not the traveller directly.
• Employer sharing is conditional on corporate agreements, employee consent and the law.
• Marketing communications are a stated purpose, subject to the marketing choices the Statement sets out later.

Data Access & Collection · Company practice

Media contact data: from a communications service provider, used to contact media, not shared, not sold

For media contact data, Hilton says it obtained the information from a third-party communications service provider rather than from the person. The only stated purpose is contacting members of the media and social media influencers in their business capacity. It states that it does not share business contact data for members of the media and social media influencers with third parties, and that the information was not sold to a third party within the past 12 months.

Supporting quotations

Media contact data

We have obtained this personal information from the following sources:

From a third-party communications service provider

We collected this personal information for the following business or commercial purposes:

Contact members of the media and social media influencers in their business capacity

We have shared this personal information with the following categories of third parties

We do not share business contact data for members of the media and social media influencers with third parties

This information was sold to a third party within the past 12 months

No

Qualifications & exceptions

• The contact is made in the person's business capacity as a member of the media or a social media influencer.
• The sale answer covers the 12 months before August 31, 2026.

Data Access & Collection · Company practice

Corporate number and name: collected from the guest, shared with employers and partners, sold

For corporate number and name, Hilton says it obtained the information directly from consumers themselves. The purposes it lists are fulfilling reservations and determining guests' eligibility for special or promotional rates. It says it shared the information with employers pursuant to corporate agreements, employee consent and as permitted by law, with Hilton's Third-Party Partner and with Hilton's Third-Party Operator, and that the information was sold to a third party within the past 12 months.

Supporting quotations

Corporate number and name

We have obtained this personal information from the following sources:

Directly from consumers themselves

We collected this personal information for the following business or commercial purposes:

Fulfill reservations

Determine guests' eligibility for special or promotional rates

We have shared this personal information with the following categories of third parties

Employers pursuant to corporate agreements, employee consent, and as permitted by law

Hilton's Third-Party Partner

Hilton's Third-Party Operator

This information was sold to a third party within the past 12 months

Yes

Qualifications & exceptions

• Employer sharing is conditional on corporate agreements, employee consent and the law.
• The sale answer covers the 12 months before August 31, 2026.

Data Access & Collection · Company practice

Travel agent number and name: from the guest and from travel agents, used to attribute reservations

For travel agent number and name, Hilton says it obtained the information directly from consumers themselves and from travel agents. The purposes it lists are attributing reservations to travel agents and fulfilling the reservation. It says it shared the information with Hilton Grand Vacations, and that the information was sold to a third party within the past 12 months.

Supporting quotations

Travel agent number and name

We have obtained this personal information from the following sources:

Directly from consumers themselves

From travel agents

We collected this personal information for the following business or commercial purposes:

Property attribute reservations to travel agents

Fulfill your reservation

We have shared this personal information with the following categories of third parties

Hilton Grand Vacations

This information was sold to a third party within the past 12 months

Yes

Qualifications & exceptions

• Attribution is a commercial purpose: the agent's identity is used to credit the booking.
• The sale answer covers the 12 months before August 31, 2026.

Data Access & Collection · Company practice

Airline partner number and name: from the guest, used to attribute Points, shared with the airlines

For airline partner number and name, Hilton says it obtained the information directly from consumers themselves. The stated purpose is properly attributing Points to consumers who participate in airline loyalty programs. It says it shared the information with the respective airlines, with Hilton's Third-Party Partner and with Hilton's Third-Party Operator, and that the information was sold to a third party within the past 12 months.

Supporting quotations

Airline partner number and name

We have obtained this personal information from the following sources:

Directly from consumers themselves

We collected this personal information for the following business or commercial purposes:

Properly attribute Points to consumers who participate in airline loyalty programs

We have shared this personal information with the following categories of third parties

The respective airlines

Hilton's Third-Party Partner

Hilton's Third-Party Operator

This information was sold to a third party within the past 12 months

Yes

Qualifications & exceptions

• Sharing with 'the respective airlines' means the airline linked to the member's own loyalty programme.
• The sale answer covers the 12 months before August 31, 2026.

Data Access & Collection · Company practice

WeChat ID: used to log into the Hilton Honors account, not shared with third parties, not sold

For the WeChat ID, Hilton says it obtained the information directly from consumers themselves and collected it to enable guests to log into their Hilton Honors account. It states plainly that it does not share customers' WeChat ID with third parties, and that the information was not sold to a third party within the past 12 months. The stated purpose is account access only.

Supporting quotations

WeChat ID

We have obtained this personal information from the following sources:

Directly from consumers themselves

We collected this personal information for the following business or commercial purposes:

Enable guests to log into Hilton Honors account

We have shared this personal information with the following categories of third parties

We do not share customers' WeChat ID with third parties

This information was sold to a third party within the past 12 months

No

Qualifications & exceptions

• The no-sharing statement is a statement by Hilton about its own sharing; it is qualified by the 12-month sale period and by the separate China appendix rules.
• The sale answer covers the 12 months before August 31, 2026.

Data Access & Collection · Company practice

WeChat name and profile photo: used for customer service, not shared, not sold

For the WeChat name and profile photo, Hilton says it obtained the information directly from consumers themselves and collected it to provide customer service and support. It states that it does not share customers' WeChat name and profile photo with third parties, and that the information was not sold to a third party within the past 12 months.

Supporting quotations

WeChat name and profile photo

We have obtained this personal information from the following sources:

Directly from consumers themselves

We collected this personal information for the following business or commercial purposes:

Provide customer service and support

We have shared this personal information with the following categories of third parties

We do not share customers' WeChat name and profile photo with third parties

This information was sold to a third party within the past 12 months

No

Qualifications & exceptions

• The no-sharing statement covers Hilton's sharing; the China appendix in the same document sets out separate rules for WeChat data in China.
• The sale answer covers the 12 months before August 31, 2026.

Data Access & Collection · Company practice

Passport or ID information: collected as law requires, shared with government agencies, not sold

For passport or ID information, Hilton says it obtained the information directly from consumers themselves and collected it pursuant to laws that require the collection of such data. It says it shared passport or ID information with government agencies pursuant to legal requirements in some countries, and that the information was not sold to a third party within the past 12 months. The stated basis is a legal requirement, not a Hilton service purpose.

Supporting quotations

Passport or ID information

We have obtained this personal information from the following sources:

Directly from consumers themselves

We collected this personal information for the following business or commercial purposes:

Pursuant to laws that require the collection of such data

We have shared this personal information with the following categories of third parties

Government agencies pursuant to legal requirements in some countries

This information was sold to a third party within the past 12 months

No

Qualifications & exceptions

• The legal trigger and the government sharing are stated globally — 'laws that require the collection of such data' and 'some countries' — rather than for a named country.
• The sale answer covers the 12 months before August 31, 2026.

Data Access & Collection · Company practice

Preferred language: read from the guest or device settings, used for service, Honors communications and analytics

For preferred language, Hilton says it obtained the information directly from consumers themselves, including from browser and computer settings, so the language preference can be inferred from the device as well as typed. The purposes it lists are better serving guests, providing a superior guest experience, sending communications relating to Hilton Honors, sending marketing communications, and performing analytics to provide guests with personalized offers and content. It says it shared the preference with Hilton's Third-Party Partner, with Hilton Partner Accommodations, with Hilton's Third-Party Operator and with Hilton Principal, and that the information was not sold to a third party within the past 12 months.

Supporting quotations

Preferred language

We have obtained this personal information from the following sources:

Directly from consumers themselves, including from browser and computer settings

We collected this personal information for the following business or commercial purposes:

Better serve our guests

Provide you with a superior guest experience

Send you communications relating to Hilton Honors

Send you marketing communications

Perform analytics in order to provide you with personalized offers and content

We have shared this personal information with the following categories of third parties

Hilton's Third-Party Partner

Hilton Partner Accommodations

Hilton's Third-Party Operator

Hilton Principal

This information was sold to a third party within the past 12 months

No

Qualifications & exceptions

• Browser and computer settings are named as a source, so the preference may be device-derived rather than chosen in a Hilton form.
• Marketing communications are a stated purpose, subject to the marketing choices the Statement sets out later.
• The sale answer covers the 12 months before August 31, 2026.

Data Access & Collection · Company practice

Room preference: collected from the guest for service, personalization and analytics

For room preference, Hilton says it obtained the information directly from consumers themselves. The purposes it lists are better serving guests, fulfilling reservations, personalizing the guest's experience, performing analytics that provide guests with personalized offers and content, and performing analytics that improve business operations. It says it shared the preference with Hilton Partner Accommodations, with Hilton's Third-Party Operator and with Hilton Principal, and that the information was not sold to a third party within the past 12 months.

Supporting quotations

Room preference

We have obtained this personal information from the following sources:

Directly from consumers themselves

We collected this personal information for the following business or commercial purposes:

Better serve our guests

Fulfill your reservations

Personalize your experience

Perform analytics to provide you with personalized offers and content

Perform analytics to improve business operations

We have shared this personal information with the following categories of third parties

Hilton Partner Accommodations

Hilton's Third-Party Operator

Hilton Principal

This information was sold to a third party within the past 12 months

No

Qualifications & exceptions

• The purposes cover the 12 months before August 31, 2026.
• Recipients are categories of third party rather than named companies.

Data Access & Collection · Company practice

Room selection and assignment: guest choice on the app, Hilton assignment, shared with partner and principal

For room selection and assignment, the source of the information is described as a combination: guests can select their rooms on the Hilton Honors app and Hilton assigns rooms. The purposes listed are better serving guests and fulfilling reservations. Hilton says it shared this information with Hilton Partner Accommodations and with Hilton Principal, and that it was not sold to a third party within the past 12 months. The category therefore combines what the guest chose with what Hilton assigned.

Supporting quotations

Room selection and assignment

We have obtained this personal information from the following sources:

Guests can select their rooms on the Hilton Honors app and Hilton assigns rooms

We collected this personal information for the following business or commercial purposes:

Better serve our guests

Fulfill reservations

We have shared this personal information with the following categories of third parties

Hilton Partner Accommodations

Hilton Principal

This information was sold to a third party within the past 12 months

No

Qualifications & exceptions

• The app room selection and the hotel's assignment are both recorded in this one category.
• The sale answer covers the 12 months before August 31, 2026.

Data Access & Collection · Company practice

Arrival time: obtained directly from consumers

For arrival time, the collection summary states that Hilton obtained the information directly from consumers themselves. The business purposes and the third-party sharing for this category are set out in the following part of the summary.

Supporting quotations

Arrival time

We have obtained this personal information from the following sources:

Directly from consumers themselves

Qualifications & exceptions

• Only the source of this category is stated in this part; the rest of the category is set out in the next part of the summary.

Data Access & Collection · Company practice

Vehicle information: from plate recognition and cameras, used for parking and safety, not shared

For vehicle information, Hilton says it obtained the information directly from consumers themselves, from license plate recognition technology and from video capabilities, so the vehicle can be identified by the guest, by reading the plate or by cameras. The purposes it lists are enabling guests to park at its properties and ensuring safety and security. It states that it does not share vehicle information with any third parties, and that the information was not sold to a third party within the past 12 months.

Supporting quotations

Vehicle information

We have obtained this personal information from the following sources:

Directly from consumers themselves

From license plate recognition technology

From video capabilities

We collected this personal information for the following business or commercial purposes:

Enable guests to park at our properties

Ensure safety and security

We have shared this personal information with the following categories of third parties

We do not share vehicle information with any third parties

This information was sold to a third party within the past 12 months

No

Qualifications & exceptions

• Two of the three sources are automated rather than the guest's own entry.
• The no-sharing statement is Hilton's own statement about its sharing.
• The sale answer covers the 12 months before August 31, 2026.

Data Access & Collection · Company practice

CCTV footage: recorded by property cameras, used for safety and legal compliance, shared in limited cases

For CCTV footage, the source is cameras located on and around the property, not the guest. The purposes are protecting guests, employees and visitors to properties, and complying with applicable laws that require this collection in some jurisdictions. Hilton says it shared the footage with government agencies pursuant to legal requirements in some countries, with employers pursuant to corporate agreements, employee consent and as permitted by law, and with entities that arranged a special rate plan, an event or a room block with Hilton, as permitted by law. It was not sold to a third party within the past 12 months.

Supporting quotations

CCTV footage

We have obtained this personal information from the following sources:

Directly from cameras located on and around the property

We collected this personal information for the following business or commercial purposes:

Protect guests, employees and visitors to properties

Comply with applicable laws that require us to collect this information in some jurisdictions

We have shared this personal information with the following categories of third parties

Government agencies pursuant to legal requirements in some countries

Employers pursuant to corporate agreements, employee consent, and as permitted by law

Entities that have arranged a special rate plan with Hilton and/or organized an event and/or room block with Hilton, as permitted by law

This information was sold to a third party within the past 12 months

No

Qualifications & exceptions

• Footage is collected by cameras on and around the property, so people other than the guest are recorded.
• Each sharing ground is qualified: legal requirements in some countries, corporate agreements and employee consent, and 'as permitted by law' for rate-plan, event and room-block entities.
• The sale answer covers the 12 months before August 31, 2026.

Data Access & Collection · Company practice

Customer interactions: cookies, server logs, beacons, tags and pixels used for analytics and marketing

For customer interactions with Hilton, the source is stated to be consumers themselves, obtained via cookies, server logs, web beacons, tags, pixels and other similar technologies. The purposes listed are performing analytics that provide personalized offers and content, performing analytics that improve business operations, marketing, sharing that data with advertising networks that serve personalized advertisements, detecting and preventing fraud, and optimizing Hilton's websites and mobile apps. It says it shared the data with advertising networks and with analytics providers for its websites and mobile applications, and that the information was sold to a third party within the past 12 months. A separate note says that if a user asks the Hilton Honors iOS app not to track across other companies' apps and websites, Hilton honours that request, while emails about searched properties and about Hilton–American Express co-branded credit cards may still arrive, those card emails not being sent based on iOS tracking.

Supporting quotations

Customer interactions with Hilton

We have obtained this personal information from the following sources:

Directly from consumers themselves via cookies, server logs, web beacons, tags, pixels, and other similar technologies

We collected this personal information for the following business or commercial purposes:

Perform analytics to provide you with personalized offers and content

Perform analytics to improve business operations

Marketing

Share that data with advertising networks who serve personalized advertisements

Detect and prevent fraud

Optimize our websites and mobile apps

We have shared this personal information with the following categories of third parties

Advertising networks

Analytics providers for our websites and mobile applications

This information was sold to a third party within the past 12 months

Yes

Note: If in the Hilton Honors iOS App you ask the App not to track you across other companies’ apps and websites, Hilton will honor that request.

Qualifications & exceptions

• The interaction data is collected through tracking technologies, so it records behaviour rather than content the guest typed.
• The sale answer covers the 12 months before August 31, 2026.
• The iOS tracking note is limited to the Hilton Honors iOS app and the cross-app tracking request; it does not withdraw marketing emails or card-related emails.

Data Access & Collection · Company practice

IP addresses: from browsing, used for analytics, advertising, payment authentication, troubleshooting and fraud

For IP addresses, the source is consumers themselves as a result of their browsing activity on the internet. The purposes listed are performing analytics that provide guests with personalized offers and content, performing analytics that improve business operations, sharing the data with advertising networks that serve personalized advertisements, conducting strong customer authentication as part of the payment process when required by law, optimizing Hilton's websites and mobile apps, troubleshooting and resolving website issues, and detecting and preventing fraud.

Supporting quotations

IP addresses

We have obtained this personal information from the following sources:

Directly from consumers themselves as a result of their browsing activity on the internet

We collected this personal information for the following business or commercial purposes:

Perform analytics in order to provide guests with personalized offers and content

Perform analytics to improve business operations

Share that data with advertising networks who serve personalized advertisements

Conduct SCA as part of the payment process, when required by law

Optimize our websites and mobile apps

Troubleshoot and resolve website issues

Detect and prevent fraud

Qualifications & exceptions

• Strong customer authentication is stated to apply only 'when required by law'.
• The purposes cover the 12 months before August 31, 2026.

Data Access & Collection · Company practice

Session IDs: from browsing, used for personalization analytics and marketing

For session IDs, the source is consumers themselves as a result of their browsing activity on the internet. The purposes listed begin with performing analytics that provide guests with personalized offers and content and marketing; the remaining purposes and the sharing and sale status for this category are set out in the following part of the summary.

Supporting quotations

Session IDs

We have obtained this personal information from the following sources:

Directly from consumers themselves as a result of their browsing activity on the internet

We collected this personal information for the following business or commercial purposes:

Perform analytics in order to provide guests with personalized offers and content

Marketing

Qualifications & exceptions

• Only the first purposes of this category are stated in this part; the rest of the category is set out in the next part of the summary.

Data Access & Collection · Company practice

Booking engine data: from browsing, used for targeted media advertising and marketing, shared with advertising networks

For booking engine data, the source is consumers as a result of their browsing activity on the internet. The purposes are showing targeted advertisements on media, supporting marketing efforts, providing customer service and performing analytics to improve business operations. Hilton says it shared the data with advertising networks, with analytics providers for its websites and mobile applications and with Hilton Principal, and that the information was sold to a third party within the past 12 months.

Supporting quotations

Booking engine

We have obtained this personal information from the following sources:

Directly from consumers as a result of their browsing activity on the internet

We collected this personal information for the following business or commercial purposes:

Show you targeted advertisements on media

Support marketing efforts

Provide customer service

Perform analytics to improve business operations

We have shared this personal information with the following categories of third parties

Advertising networks

Analytics providers for our websites and mobile applications

Hilton Principal

This information was sold to a third party within the past 12 months

Yes

Qualifications & exceptions

• The sale answer covers the 12 months before August 31, 2026.
• The booking engine data is behaviour from browsing, not the reservation itself.

Data Access & Collection · Company practice

Streaming service usage: from Connected Room login, used to evaluate streaming usage, not shared

For streaming service usage, the source is consumers as a result of their logging into a streaming service through the Connected Room functionality. The only stated purpose is evaluating the usage of different streaming services. Hilton says it does not share streaming service usage with third parties, and that the information was not sold to a third party within the past 12 months.

Supporting quotations

Streaming service usage

We have obtained this personal information from the following sources:

Directly from consumers as a result of their logging into a streaming service through Connected Room functionality

We collected this personal information for the following business or commercial purposes:

Evaluate the usage of different streaming services

We have shared this personal information with the following categories of third parties

We do not share streaming service usage with third parties

This information was sold to a third party within the past 12 months

No

Qualifications & exceptions

• The data arises when a guest logs into a third-party streaming service in the room.
• The sale answer covers the 12 months before August 31, 2026.

Data Access & Collection · Company practice

Hilton and Amex co-branded card data: from American Express, used for card benefits and marketing

For the Hilton and Amex credit card category, the source is American Express, not the guest directly. The purposes are providing the benefits associated with the co-branded card, showing targeted advertisements on media, supporting marketing efforts, providing customer service and performing analytics to improve business operations. The stated purposes do not include any payments-related use, although the following sharing entry names payment card issuers and processors as a recipient of this data.

Supporting quotations

Hilton and Amex credit card

We have obtained this personal information from the following sources:

From American Express

We collected this personal information for the following business or commercial purposes:

Provide you with benefits associated with your co-branded card

Show you targeted advertisements on media

Support marketing efforts

Provide customer service

Perform analytics to improve business operations

Qualifications & exceptions

• The source is the co-branded partner, so Hilton receives the data from American Express.
• The purposes cover the 12 months before August 31, 2026.

Data Access & Collection · Company practice

Hilton and Amazon account data: from Amazon, used for Shop with Points, advertising and marketing

For the Hilton and Amazon accounts category, the source is Amazon. The purposes are facilitating use of Honors Points as part of Amazon's Shop with Points program, showing targeted advertisements on media, supporting marketing efforts, providing customer service and performing analytics to improve business operations. Hilton says it shared the data with advertising networks and with analytics providers for its websites and mobile applications, and that the information was not sold to a third party within the past 12 months.

Supporting quotations

Hilton and Amazon accounts

We have obtained this personal information from the following sources:

From Amazon

We collected this personal information for the following business or commercial purposes:

Facilitate use of Honors Points as part of Amazon's Shop with Points program

Show you targeted advertisements on media

Support marketing efforts

Provide customer service

Perform analytics to improve business operations

We have shared this personal information with the following categories of third parties

Advertising networks

Analytics providers for our websites and mobile applications

This information was sold to a third party within the past 12 months

No

Qualifications & exceptions

• The source is the partner account, so the data reaches Hilton from Amazon.
• The sale answer covers the 12 months before August 31, 2026.

Data Access & Collection · Company practice

Hilton and Lyft account data: from Lyft, used for advertising, marketing and analytics

For the Hilton and Lyft accounts category, the source is Lyft. The purposes are showing targeted advertisements on media, supporting marketing efforts, providing customer service and performing analytics to improve business operations. Hilton says it shared the data with advertising networks, with analytics providers for its websites and mobile applications and with Hilton Honors affiliated partners, and that the information was not sold to a third party within the past 12 months. No ride-hailing or transportation purpose is stated in this category.

Supporting quotations

Hilton and Lyft accounts

We have obtained this personal information from the following sources:

From Lyft

We collected this personal information for the following business or commercial purposes:

Show you targeted advertisements on media

Support marketing efforts

Provide customer service

Perform analytics to improve business operations

We have shared this personal information with the following categories of third parties

Advertising networks

Analytics providers for our websites and mobile applications

Hilton Honors affiliated partners

This information was sold to a third party within the past 12 months

No

Qualifications & exceptions

• The source is the partner account, so the data reaches Hilton from Lyft.
• The sale answer covers the 12 months before August 31, 2026.

Data Access & Collection · Company practice

Geolocation information: from browsing and app use, used for room access, Digital Key, analytics and marketing

For geolocation information, the source is consumers as a result of their browsing activity on the internet and their use of the Hilton Honors app. The purposes listed are enabling guest access to guest room and hotel facilities, fulfilling Digital Key sharing requests, performing analytics that provide guests with personalized offers and content, marketing, and detecting and preventing fraud. Hilton states that it does not share geolocation information with any third parties; the sale status for this category is set out in the following part of the summary.

Supporting quotations

Geolocation information

We have obtained this personal information from the following sources:

Directly from consumers as a result of their browsing activity on the internet and use of the Hilton Honors app

We collected this personal information for the following business or commercial purposes:

Enable guest access to guest room and hotel facilities

Fulfill Digital Key sharing requests

Perform analytics in order to provide guests with personalized offers and content

Marketing

Detect and prevent fraud

We have shared this personal information with the following categories of third parties

We do not share geolocation information with any third parties.

Qualifications & exceptions

• The data combines internet browsing location with in-app location, so it is not limited to the property.
• The no-sharing statement covers Hilton's own sharing of geolocation information.

Data Access & Collection · Company practice

Device information: from browsing, QR scans and the Honors app, used for analytics, marketing and advertising

For device information, Hilton says it obtained the information from consumers as a result of their browsing activity on the internet, scanning of QR codes on property, and use of the Hilton Honors app. The purposes are performing analytics that provide personalized offers and content, marketing, sharing the data with advertising networks that serve personalized advertisements, and detecting and preventing fraud. It says it shared the data with advertising networks and with analytics providers for its websites and mobile applications, and that the information was sold to a third party within the past 12 months.

Supporting quotations

Device information

We have obtained this personal information from the following sources:

Directly from consumers as a result of their browsing activity on the internet, scanning of QR codes on property, and use of the Hilton Honors app

We collected this personal information for the following business or commercial purposes:

Perform analytics to provide you with personalized offers and content

Marketing

Share that data with advertising networks who serve personalized advertisements

Detect and prevent fraud

We have shared this personal information with the following categories of third parties

Advertising networks

Analytics providers for our websites and mobile applications

This information was sold to a third party within the past 12 months

Yes

Qualifications & exceptions

• The sources include on-property QR scanning and app use, not only web browsing.
• The sale answer covers the 12 months before August 31, 2026.

Data Access & Collection · Company practice

Social media information: from the guest, from public social channels and public online sources, not shared

For social media information, Hilton names three sources: directly from consumers themselves; indirectly from consumers by reviewing publicly available information on their social media channels; and from publicly available online sources. The purposes are performing analytics that provide guests with personalized offers and content, responding to service concerns in order to better serve guests, and providing a more personalized welcome and stay experience. Hilton states that it does not share social media information or publicly available online information with any third parties, and that the information was not sold to a third party within the past 12 months.

Supporting quotations

Social media information

We have obtained this personal information from the following sources:

Directly from consumers themselves

Indirectly from consumers by reviewing publicly available information on their social media channels

From publicly available online sources

We collected this personal information for the following business or commercial purposes:

Perform analytics in order to provide guests with personalized offers and content

Respond to service concerns in order to better serve our guests

Provide a more personalized welcome and stay experience

We have shared this personal information with the following categories of third parties

We do not share social media information or publicly available online information with any third parties

This information was sold to a third party within the past 12 months

No

Qualifications & exceptions

• Two of the three sources are information Hilton finds without the guest giving it to Hilton directly.
• The no-sharing statement covers social media information and publicly available online information.
• The sale answer covers the 12 months before August 31, 2026.

Data Access & Collection · Company practice

MyWay preferences: from the guest, used for service and requested communications

For the guest's MyWay preferences, Hilton says it obtained the information directly from consumers themselves. The purposes are better serving guests and sending the communications the guest would like to receive. It says it shared the preferences with Hilton Partner Accommodations, with Hilton's Third-Party Operator and with Hilton Principal, and that the information was not sold to a third party within the past 12 months.

Supporting quotations

Your MyWay preferences

We have obtained this personal information from the following sources:

Directly from consumers themselves

We collected this personal information for the following business or commercial purposes:

Better serve our guests

Send you the communications you would like to receive

We have shared this personal information with the following categories of third parties

Hilton Partner Accommodations

Hilton's Third-Party Operator

Hilton Principal

This information was sold to a third party within the past 12 months

No

Qualifications & exceptions

• The stated purpose includes sending the communications the guest asked for, which is distinct from marketing communications the guest did not request.
• Recipients are categories of third party rather than named companies.

Data Access & Collection · Company practice

Email and consent preferences: from the guest, used for service and requested communications, shared with advertising

For email and consent preferences, Hilton says it obtained the information directly from consumers themselves. The purposes are better serving guests and sending the communications the guest would like to receive. It says it shared the preferences with advertising networks, and that the information was not sold to a third party within the past 12 months. Consent choices are therefore recorded and, unlike the MyWay preferences category, are shared with advertising networks.

Supporting quotations

Email and consent preferences

We have obtained this personal information from the following sources:

Directly from consumers themselves

We collected this personal information for the following business or commercial purposes:

Better serve our guests

Send you the communications you would like to receive

We have shared this personal information with the following categories of third parties

Advertising networks

This information was sold to a third party within the past 12 months

No

Qualifications & exceptions

• The sale answer covers the 12 months before August 31, 2026.
• The Statement's separate marketing choices section explains how consent is withdrawn; this category records the preference.

Data Access & Collection · Company practice

Personal preferences: from the guest, used for service, shared with partner accommodations, not sold

For personal preferences, Hilton says it obtained the information directly from consumers themselves. The purposes are better serving guests and providing customer service and support. It says it shared the preferences with Hilton Partner Accommodations, and that the information was not sold to a third party within the past 12 months.

Supporting quotations

Personal preferences

We have obtained this personal information from the following sources:

Directly from consumers themselves

We collected this personal information for the following business or commercial purposes:

Better serve our guests

Provide customer service and support

We have shared this personal information with the following categories of third parties

Hilton Partner Accommodations

This information was sold to a third party within the past 12 months No

Qualifications & exceptions

• Only partner accommodations are listed as recipients for this category.
• The sale answer covers the 12 months before August 31, 2026.

Data Access & Collection · Company practice

On-site incidents: reported by guests, employees or law enforcement, used for safety, service and legal compliance

For on-site incidents, Hilton names three sources: directly from consumers themselves, directly from Hilton employees, and directly from law enforcement. The purposes are responding to safety and security concerns, better serving guests, and complying with legal or contractual obligations. It says it shared incident information with law enforcement, with employers pursuant to corporate agreements, employee consent and as permitted by law, and with entities that arranged a special rate plan, an event or a room block with Hilton; the sharing list continues in the next part of the summary.

Supporting quotations

On-site incidents

We have obtained this personal information from the following sources:

Directly from consumers themselves

Directly from Hilton employees

Directly from law enforcement

We collected this personal information for the following business or commercial purposes:

Respond to safety and security concerns

Better serve our guests

Comply with legal or contractual obligations

We have shared this personal information with the following categories of third parties

Law enforcement

Employers pursuant to corporate agreements, employee consent, and as permitted by law

Entities that have arranged a special rate plan with Hilton and/or organized an event and/or room block with Hilton

Qualifications & exceptions

• One source is law enforcement, so incidents can enter Hilton's records from official channels rather than from the guest.
• Employer sharing is conditional on corporate agreements, employee consent and the law.

Data Access & Collection · Company practice

Complaint descriptions: from the guest, used for safety, service and legal compliance, shared with franchise owners

For complaint descriptions, Hilton says it obtained the information directly from consumers themselves. The purposes are responding to safety and security concerns, better serving guests, and complying with legal or contractual obligations. It says it shared the complaint description with the management and/or owners of a franchise property if the complaint relates to that property, and that the information was not sold to a third party within the past 12 months.

Supporting quotations

Complaint descriptions

We have obtained this personal information from the following sources:

Directly from consumers themselves

We collected this personal information for the following business or commercial purposes:

Respond to safety and security concerns

Better serve our guests

Comply with legal or contractual obligations

We have shared this personal information with the following categories of third parties

The management and/or owners of a franchise property if your complaint relates to that property

This information was sold to a third party within the past 12 months

No

Qualifications & exceptions

• Franchise owners receive the complaint only where the complaint relates to their property.
• The sale answer covers the 12 months before August 31, 2026.

Data Access & Collection · Company practice

Free form textual feedback: from the guest, used for troubleshooting and improvement, not shared

For free form textual feedback, Hilton says it obtained the information directly from consumers themselves. The purposes are troubleshooting and resolving website issues and improving the customer experience. It states that it does not share the guest's feedback with any third parties, and that the information was not sold to a third party within the past 12 months. Unlike ratings and survey responses, this category carries no publication purpose.

Supporting quotations

Free form textual feedback

We have obtained this personal information from the following sources:

Directly from consumers themselves

We collected this personal information for the following business or commercial purposes:

Troubleshoot and resolve website issues

Improve customer experience

We have shared this personal information with the following categories of third parties

We do not share your feedback with any third parties

This information was sold to a third party within the past 12 months

No

Qualifications & exceptions

• The sale answer covers the 12 months before August 31, 2026.

Data Access & Collection · Company practice

Spa and wellness service information: date, time and service type, used for safety and compliance, not shared

For spa and wellness service information, Hilton describes the information as such as date, time and type of service, obtained directly from consumers themselves. The purposes are responding to safety and security concerns, better serving guests, and complying with legal or contractual obligations. Hilton states that it does not share spa and wellness service or treatment details with any third parties, and that the information was not sold to a third party within the past 12 months.

Supporting quotations

Spa and wellness service information

We have obtained this personal information (such as date, time, and type of service) from the following sources:

Directly from consumers themselves

We collected this personal information for the following business or commercial purposes:

Respond to safety and security concerns

Better serve our guests

Comply with legal or contractual obligations

We have shared this personal information with the following categories of third parties

We do not share your spa and wellness service or treatment details with any third parties.

This information was sold to a third party within the past 12 months

No

Qualifications & exceptions

• The category covers service details such as date, time and type of service.
• The sale answer covers the 12 months before August 31, 2026.

Data Access & Collection · Company practice

Spending amount: from the guest, used for service, analytics, marketing and financial reporting, shared with card

For spending amount, Hilton says it obtained the information directly from consumers themselves. The purposes are better serving guests, performing analytics to improve business operations, supporting marketing efforts, and fulfilling obligations for business reporting, auditing, tax and income reconciliation. It says it shared the amount with payment card issuers and payment processors, and that the information was not sold to a third party within the past 12 months.

Supporting quotations

Spending amount

We have obtained this personal information from the following sources:

Directly from consumers themselves

We collected this personal information for the following business or commercial purposes:

Better serve our guests

Perform analytics to improve business operations

Support marketing efforts

Fulfill obligations for business reporting, auditing, tax, and income reconciliation

We have shared this personal information with the following categories of third parties

Payment card issuers and payment processors

This information was sold to a third party within the past 12 months

No

Qualifications & exceptions

• One stated purpose is meeting financial and reporting obligations rather than serving the guest.
• The sale answer covers the 12 months before August 31, 2026.

Data Access & Collection · Company practice

Stay add-ons such as parking, pets, time and extra add-ons: from the guest, shared with Hilton Principal

For stay add-ons — the document lists parking, pets, time and extra add-ons — Hilton says it obtained the information directly from consumers themselves. The purposes are better serving guests and improving the customer experience. It says it shared the information with Hilton Principal, and that the information was not sold to a third party within the past 12 months.

Supporting quotations

Stay Add-Ons (such as parking, pets, time, and extra add-ons)

We have obtained this personal information from the following sources:

Directly from consumers themselves

We collected this personal information for the following business or commercial purposes:

Better serve our guests

Improve customer experience

We have shared this personal information with the following categories of third parties

Hilton Principal

This information was sold to a third party within the past 12 months

No

Qualifications & exceptions

• The category covers the add-ons bought during a stay, such as parking, pets and extra time.
• The sale answer covers the 12 months before August 31, 2026.

Data Access & Collection · Company practice

Point of collection: categories and purposes disclosed when you browse a Hilton website

The Statement adds a notice at the point of collection. For browsing Hilton websites it says that it collects categories of personal information about the visitor, which are used for stated purposes, and the first category is interaction information with Hilton websites, apps, emails or ads — such as open time, clicked links and version — collected in order to show targeted advertisements on marketing efforts including media, email and chat, with the example that a search for Hilton properties in New York City can lead to a Hilton advertisement on a non-Hilton website. The remaining categories and purposes of this notice follow in the next part of the section.

Supporting quotations

Browsing Hilton Websites

When you browse a Hilton website, we collect the following categories of personal information about you, which are used for the following purposes:

Interaction information with Hilton websites, apps, emails or ads (such as open time, clicked links, and version)

We collect this information in order to:

Show you targeted advertisements on marketing efforts including media, email, and chat

Qualifications & exceptions

• The point-of-collection notice is the short, activity-based list; the general collection summary in the same document is the fuller retrospective list.
• The advertising example is given as an illustration of what may happen, not as a promise that it will.

Data Access & Collection · Company practice

Point of collection, browsing: IP address and its purposes

In the point-of-collection notice for browsing, the IP address is collected in order to: perform analytics that provide guests with personalized offers and content; show targeted advertisements on media; optimize Hilton's websites and mobile apps; perform analytics that improve business operations; share the data with advertising networks that serve personalized advertisements; conduct strong customer authentication as part of the payment process when required by law; troubleshoot and resolve website issues; and detect and prevent fraud.

Supporting quotations

IP address

We collect this information in order to:

Perform analytics in order to provide guests with personalized offers and content

Show you targeted advertisements on media

Optimize our websites and mobile apps

Perform analytics to improve business operations

Share that data with advertising networks who serve personalized advertisements

Conduct SCA as part of the payment process, when required by law

Troubleshoot and resolve website issues

Detect and prevent fraud

Qualifications & exceptions

• Strong customer authentication is stated to apply only 'when required by law'.
• The point-of-collection list states purposes, not the recipients of the data; the sharing list is given in the general collection summary.

Data Access & Collection · Company practice

Point of collection, browsing: session ID and its purposes

In the point-of-collection notice for browsing, the session ID is collected in order to: perform analytics that provide guests with personalized offers and content; marketing; show targeted advertisements on media; optimize Hilton's websites and mobile apps; perform analytics that improve business operations; share the data with advertising networks that serve personalized advertisements; and detect and prevent fraud.

Supporting quotations

Session ID

We collect this information in order to:

Perform analytics in order to provide guests with personalized offers and content

Marketing

Show you targeted advertisements on media

Optimize our websites and mobile apps

Perform analytics to improve business operations

Share that data with advertising networks who serve personalized advertisements

Detect and prevent fraud

Qualifications & exceptions

• The point-of-collection list states purposes, not the recipients of the data.

Data Access & Collection · Company practice

Point of collection, browsing: booking engine data and its purposes

In the point-of-collection notice for browsing, booking engine data is collected in order to: show targeted advertisements on media; support marketing efforts; provide customer service; and perform analytics to improve business operations.

Supporting quotations

Booking engine

We collect this information in order to:

Show you targeted advertisements on media

Support marketing efforts

Provide customer service

Perform analytics to improve business operations

Qualifications & exceptions

• The point-of-collection list states purposes, not the recipients of the data.

Data Access & Collection · Company practice

Point of collection, browsing: Hilton and Lyft account data and its purposes

In the point-of-collection notice for browsing, data linked to a member's Hilton and Lyft accounts is collected in order to: show targeted advertisements on media; support marketing efforts; provide customer service; and perform analytics to improve business operations.

Supporting quotations

Hilton and Lyft accounts

We collect this information in order to:

Show you targeted advertisements on media

Support marketing efforts

Provide customer service

Perform analytics to improve business operations

Qualifications & exceptions

• The point-of-collection list states purposes, not the recipients of the data.

Data Access & Collection · Company practice

Point of collection: information collected when a member logs in during a browsing session

The notice says that if a Hilton Honors member logs into their account during a browsing session, Hilton collects the following information about them and uses it for the following purposes. The first category is internet or network activity information, collected in order to: show targeted advertisements on marketing efforts including media, email and chat; optimize Hilton's websites and mobile apps; perform analytics that improve business operations; perform analytics that provide guests with personalized offers and content; marketing; share that data with advertising networks that serve personalized advertisements; and detect and prevent fraud. The advertising example given is that a search for Hilton properties in New York City can lead to a Hilton advertisement on a non-Hilton website.

Supporting quotations

If you are a Hilton Honors member and you log into your account during your browsing session, then we collect the following information about you, which is used for the following purposes:

Internet or network activity information

We collect this information in order to:

Show you targeted advertisements on marketing efforts including media, email, and chat

Optimize our websites and mobile apps

Perform analytics to improve business operations

Perform analytics in order to provide guests with personalized offers and content

Marketing

Share that data with advertising networks who serve personalized advertisements

Detect and prevent fraud

Qualifications & exceptions

• This collection is described for members who log in during browsing; the other categories of the logged-in list follow in the next part of the section.
• The New York City example illustrates what may happen rather than promising that it will.

Data Access & Collection · Company practice

Point of collection, logged-in browsing: IP address and its purposes

Within the logged-in browsing list, the IP address is collected in order to: perform analytics that provide guests with personalized offers and content; share that data with advertising networks that serve personalized advertisements; conduct strong customer authentication as part of the payment process when required by law; show targeted advertisements on media; optimize Hilton's websites and mobile apps; troubleshoot and resolve website issues; perform analytics that improve business operations; and detect and prevent fraud.

Supporting quotations

IP address

We collect this information in order to:

Perform analytics in order to provide guests with personalized offers and content

Share that data with advertising networks who serve personalized advertisements

Conduct SCA as part of the payment process, when required by law

Show you targeted advertisements on media

Optimize our websites and mobile apps

Troubleshoot and resolve website issues

Perform analytics to improve business operations

Detect and prevent fraud

Qualifications & exceptions

• Strong customer authentication is stated to apply only 'when required by law'.
• The point-of-collection list states purposes, not the recipients of the data.

Data Access & Collection · Company practice

Point of collection, logged-in browsing: session ID and its purposes

Within the logged-in browsing list, the session ID is collected in order to: perform analytics that provide guests with personalized offers and content; show targeted advertisements on media; optimize Hilton's websites and mobile apps; perform analytics that improve business operations; share that data with advertising networks who serve personalized advertisements; and detect and prevent fraud.

Supporting quotations

Session ID

We collect this information in order to:

Perform analytics in order to provide guests with personalized offers and content

Show you targeted advertisements on media

Optimize our websites and mobile apps

Perform analytics to improve business operations

Share that data with advertising networks who serve personalized advertisements

Detect and prevent fraud

Qualifications & exceptions

• The point-of-collection list states purposes, not the recipients of the data.

Data Access & Collection · Company practice

Point of collection, logged-in browsing: customer ratings and survey responses

Within the logged-in browsing list, customer ratings and survey responses are collected in order to troubleshoot and resolve website issues and to improve the customer experience.

Supporting quotations

Customer ratings and survey responses

We collect this personal information in order to:

Troubleshoot and resolve website issues

Improve customer experience

Qualifications & exceptions

• The point-of-collection list states purposes, not the recipients of the data.

Data Access & Collection · Company practice

Point of collection, logged-in browsing: free form textual feedback

Within the logged-in browsing list, free form textual feedback is collected in order to troubleshoot and resolve website issues and to improve the customer experience.

Supporting quotations

Free form textual feedback

We collect this personal information in order to:

Troubleshoot and resolve website issues

Improve customer experience

Qualifications & exceptions

• The point-of-collection list states purposes, not the recipients of the data.

Data Access & Collection · Company practice

Point of collection, logged-in browsing: Hilton Honors number and its purposes

Within the logged-in browsing list, the Hilton Honors number is collected in order to: look up and verify the member's Hilton Honors account and reservation; fulfill guest reservations; send guests communications relating to their reservations; administer membership and activity in the loyalty program; support marketing efforts; provide customer service and support; troubleshoot and resolve website issues; send marketing communications by email, direct mail and social media; perform analytics that provide guests with personalized offers and content; perform analytics that improve business operations; determine guests' eligibility for special or promotional rates; process payments; process transactions with partners; administer contests and sweepstakes; and detect and prevent fraud.

Supporting quotations

Hilton Honors number

We collect this personal information in order to:

Look up and verify your Hilton Honors account and reservation

Fulfill guest reservations

Send guests communications relating to their reservations

Administer membership and activity in the Hilton Honors loyalty program

Support marketing efforts

Provide customer service and support

Troubleshoot and resolve website issues

Send marketing communications via email, direct mail, and social media

Perform analytics in order to provide guests with personalized offers and content

Perform analytics to improve business operations

Determine guests’ eligibility for special or promotional rates

Process payments

Process transactions with partners

Administer contests and sweepstakes

Qualifications & exceptions

• This is the point-of-collection list of purposes; the general collection summary in the same document states the same uses for the 12 months before August 31, 2026.
• Marketing and marketing communications appear here among the purposes of collecting the loyalty number.

Data Access & Collection · Company practice

Point of collection, making a reservation: tier, purposes and the categories collected

The point-of-collection notice for making a reservation starts with the member's Hilton Honors tier, collected in order to support marketing efforts, provide customer service and troubleshoot and resolve website issues, and then states that when a reservation is made at a Hilton property, Hilton collects the following categories of personal information, used for the following purposes. The categories and purposes are set out in the rest of this section. The tier is the first item in the list, so a reservation records the member's loyalty status as well as the booking details.

Supporting quotations

Detect and prevent fraud

Hilton Honors tier

We collect this personal information in order to:

Support marketing efforts

Provide customer service

Troubleshoot and resolve website issues

Making a Reservation

When you make a reservation at a Hilton property, we collect the following categories of personal information about you, which are used for the following purposes:

Qualifications & exceptions

• The notice covers reservations at a Hilton property made through this channel; other booking channels and their own notices are separate.
• The remaining categories of the list are set out in the following parts of the section.

Data Access & Collection · Company practice

Point of collection, reservation: name and its purposes

In the reservation list, the guest's name is collected in order to: look up and verify the reservation; fulfill the reservation; send communications relating to the reservation; administer membership and activity in the Hilton Honors loyalty program; provide customer service and support; and send marketing communications by email and direct mail. The remaining purposes of this category are set out in the next part of the list.

Supporting quotations

Name

We collect this information in order to:

Look up and verify your reservation

Fulfill your reservation

Send you communications relating to your reservation

Administer membership and activity in the Hilton Honors loyalty program

Provide customer service and support

Send you marketing communications via email and direct mail

Qualifications & exceptions

• Marketing by email and direct mail is a stated purpose of the name in the reservation list, subject to the marketing choices the Statement sets out.

Data Access & Collection · Company practice

Point of collection, reservation: name — analytics, payments and sharing

The remaining stated purposes for the name in the reservation list are: performing analytics that provide guests with personalized offers and content; performing analytics that improve business operations; determining eligibility for special or promotional rates; processing payments; processing transactions with partners; administering contests and sweepstakes; optimizing Hilton's websites and mobile apps; and detecting and preventing fraud. The Statement also says the information is shared with Hilton Principal, Hilton's Third-Party Partner, Hilton Partner Accommodations and Hilton's Third-Party Operator.

Supporting quotations

Perform analytics to provide guests with personalized offers and content

Perform analytics to improve business operations

Determine your eligibility for special or promotional rates

Process payments

Process transactions with partners

Share this information with Hilton Principal, Hilton’s Third-Party Partner Hilton Partner Accommodations, and Hilton’s Third-Party Operator

Administer contests and sweepstakes

Optimize our websites and mobile apps

Detect and prevent fraud

Qualifications & exceptions

• The sharing line for this category names the recipients; it does not state a legal basis.
• The point-of-collection list covers the reservation journey, not the 12-month retrospective summary.

Data Access & Collection · Company practice

Point of collection, reservation: additional names

In the reservation list, additional names are collected in order to fulfill the reservation, and the Statement says the information is shared with Hilton Partner Accommodations and Hilton's Third-Party Operator. These are the names of other guests on the booking, so the collection concerns other individuals as well as the person making the reservation.

Supporting quotations

Additional names

We collect this information in order to:

Fulfill your reservation

Share this information with Hilton Partner Accommodations and Hilton's Third-Party Operator

Qualifications & exceptions

• The sharing line names the recipients for this category.

Data Access & Collection · Company practice

Point of collection, reservation: Hilton Honors number and its purposes and sharing

In the reservation list, the Hilton Honors number is collected in order to: look up and verify the member's Hilton Honors account and reservation; administer the member's Hilton Honors membership; fulfill guest reservations; send guests communications relating to their reservations; provide customer service and support; send marketing communications by email, direct mail and social media; perform analytics that provide guests with personalized offers and content; perform analytics that improve business operations; determine guests' eligibility for special or promotional rates; process payments; process transactions with partners; administer contests and sweepstakes; and detect and prevent fraud. The information is shared with Hilton Principal, Hilton Partner Accommodations and Hilton's Third-Party Operator.

Supporting quotations

Hilton Honors number

We collect this personal information in order to:

Look up and verify your Hilton Honors account and reservation

Administer your membership in Hilton Honors

Fulfill guest reservations

Send guests communications relating to their reservations

Provide customer service and support

Send marketing communications via email, direct mail, and social media

Perform analytics in order to provide guests with personalized offers and content

Perform analytics to improve business operations

Determine guests’ eligibility for special or promotional rates

Process payments

Process transactions with partners

Share this information with Hilton Principal, Hilton Partner Accommodations and Hilton’s Third-Party Operator

Administer contests and sweepstakes

Detect and prevent fraud

Qualifications & exceptions

• The sharing line for this category names the recipients.
• Marketing communications are a stated purpose of collecting the loyalty number in the reservation list.

Data Access & Collection · Company practice

Point of collection, reservation: phone number, its purposes and sharing

In the reservation list, the phone number is collected in order to: verify identity; fulfill the reservation; send text messages relating to check-in and any services needed during the stay; send marketing communications by SMS; provide customer service and support; perform analytics that provide personalized offers and content; perform analytics that improve business operations; process transactions with partners; detect and prevent fraud; and engage in sales activity for group bookings, meetings and events. The information is shared with Hilton Principal, Hilton's Third-Party Partner, Hilton Partner Accommodations and Hilton's Third-Party Operator.

Supporting quotations

Phone number

We collect this information in order to:

Verify identity

Fulfill your reservation

Send you text messages relating to check-in and any services you may need during your stay

Send marketing communications via SMS

Provide customer service and support

Perform analytics in order to provide you with personalized offers and content

Perform analytics to improve business operations

Process transactions with partners

Share this information with Hilton Principal, Hilton’s Third-Party Partner, Hilton Partner Accommodations, and Hilton’s Third-Party Operator

Detect and prevent fraud

Engage in sales activity for group bookings, meetings and events

Qualifications & exceptions

• Text messages about check-in and in-stay services are a service use, distinct from SMS marketing, which is a separate listed purpose.
• The sharing line for this category names the recipients.

Data Access & Collection · Company practice

Point of collection, reservation: address, its purposes and sharing

In the reservation list, the address is collected in order to: administer the member's membership in the Hilton Honors loyalty program; verify the member's Hilton Honors account; send communications relating to Hilton Honors; send marketing communications; perform analytics that provide personalized offers and content; perform analytics that improve business operations; determine eligibility for special or promotional rates; process payments; process transactions with partners; and detect and prevent fraud. The information is shared with Hilton Principal, Hilton's Third-Party Partner, Hilton Partner Accommodations and Hilton's Third-Party Operator.

Supporting quotations

Address

We collect this information in order to:

Administer your membership in the Hilton Honors loyalty program

Verify your Hilton Honors account

Send you communications relating to Hilton Honors

Send you marketing communications

Perform analytics in order to provide you with personalized offers and content

Perform analytics to improve business operations

Determine your eligibility for special or promotional rates

Process payments

Process transactions with partners

Share this information with Hilton Principal, Hilton’s Third-Party Partner, Hilton Partner Accommodations, and Hilton’s Third-Party Operator

Detect and prevent fraud

Qualifications & exceptions

• The sharing line for this category names the recipients.
• Marketing communications are a stated purpose of collecting the address in the reservation list.

Data Access & Collection · Company practice

Point of collection, reservation: address type (home/work)

In the reservation list, the address type — whether the address is a home or work address — is collected in order to perform analytics that provide personalized offers and content. The information is shared with Hilton Principal, Hilton Partner Accommodations and Hilton's Third-Party Operator.

Supporting quotations

Address type (home/work)

We collect this information in order to:

Perform analytics in order to provide you with personalized offers and content

Share this information with Hilton Principal, Hilton Partner Accommodations and Hilton’s Third-Party Operator

Qualifications & exceptions

• This is the only stated purpose for the address type in the reservation list.
• The sharing line for this category names the recipients.

Data Access & Collection · Company practice

Point of collection, reservation: email address and its purposes

In the reservation list, the email address is collected in order to: administer the member's membership in the Hilton Honors loyalty program; verify the member's Hilton Honors account; associate the reservation with the member's Hilton Honors account; send communications relating to Hilton Honors; send marketing communications; perform analytics that provide personalized offers and content; perform analytics that improve business operations; determine eligibility for special or promotional rates; and process transactions with partners. The sharing statement for this category follows in the next part of the list.

Supporting quotations

Email address

We collect this information in order to:

Administer your membership in the Hilton Honors loyalty program

Verify your Hilton Honors account

Associate your reservation with your Hilton Honors account

Send you communications relating to Hilton Honors

Send you marketing communications

Perform analytics in order to provide you with personalized offers and content

Perform analytics to improve business operations

Determine your eligibility for special or promotional rates

Process transactions with partners

Qualifications & exceptions

• Associating the reservation with the Honors account is a stated purpose, so a booking made without logging in can still be linked to the account.
• Only the first purposes of this category are stated in this part of the list.

Data Access & Collection · Company practice

Point of collection, reservation: email address — sharing, fraud, mobile authentication and group sales

The reservation list completes the email address category: the information is shared with Hilton Principal, Hilton's Third-Party Partner, Hilton Partner Accommodations and Hilton's Third-Party Operator, and the further stated purposes are detecting and preventing fraud, authenticating a mobile account, and engaging in sales activity for group bookings, meetings and events.

Supporting quotations

Share this information with Hilton Principal, Hilton’s Third-Party Partner, Hilton Partner Accommodations, and Hilton’s Third-Party Operator

Detect and prevent fraud

Authenticate mobile account

Engage in sales activity for group bookings, meetings, and events

Qualifications & exceptions

• The sharing line names the recipients for this category.

Data Access & Collection · Company practice

Point of collection, reservation: preferred language

In the reservation list, the preferred language is collected in order to: provide a superior guest experience; send communications relating to Hilton Honors; send marketing communications; perform analytics that provide personalized offers and content; and is shared with Hilton Principal, Hilton's Third-Party Partner, Hilton Partner Accommodations and Hilton's Third-Party Operator. Unlike the general collection summary, this entry has no separate fraud-prevention or business-analytics line.

Supporting quotations

Preferred language

We collect this information in order to:

Provide you with a superior guest experience

Send you communications relating to Hilton Honors

Send you marketing communications

Perform analytics in order to provide you with personalized offers and content

Share this information with Hilton Principal, Hilton’s Third-Party Partner, Hilton Partner Accommodations, and Hilton’s Third-Party Operator

Qualifications & exceptions

• The sharing line names the recipients for this category.

Data Access & Collection · Company practice

Point of collection, reservation: payment card information

In the reservation list, payment card information is collected in order to process payments, and it is shared with Hilton Principal, Hilton Partner Accommodations and Hilton's Third-Party Operator. The further stated purpose is detecting and preventing fraud. No sale or marketing purpose is listed for card data in this entry.

Supporting quotations

Payment card information

We collect this information in order to:

Process payments

Share this information with Hilton Principal, Hilton Partner Accommodations, and Hilton’s Third-Party Operator

Detect and prevent fraud

Qualifications & exceptions

• The sharing line names the recipients for this category.

Data Access & Collection · Company practice

Point of collection, reservation: room preference

In the reservation list, the room preference is collected in order to: fulfill the reservation; personalize the guest's experience; perform analytics that provide personalized offers and content; perform analytics that improve business operations; and is shared with Hilton Principal, Hilton Partner Accommodations and Hilton's Third-Party Operator.

Supporting quotations

Room preference

We collect this information in order to:

Fulfill your reservations

Personalize your experience

Perform analytics to provide you with personalized offers and content

Perform analytics to improve business operations

Share this information with Hilton Principal, Hilton Partner Accommodations, and Hilton’s Third-Party Operator

Qualifications & exceptions

• The sharing line names the recipients for this category.

Data Access & Collection · Company practice

Point of collection, reservation: corporate name and number

In the reservation list, the corporate name and number are collected in order to: fulfill the reservation; determine eligibility for special or promotional rates; and are shared with Hilton's Third-Party Partner. No marketing or analytics purpose is listed for this category in the reservation notice.

Supporting quotations

Corporate name and number

We collect this information in order to:

Fulfill your reservation

Determine your eligibility for special or promotional rates

Share this information with Hilton’s Third-Party Partner

Qualifications & exceptions

• The sharing line names the recipient for this category.

Data Access & Collection · Company practice

Point of collection, reservation: travel agent name and number

In the reservation list, the travel agent's name and number are collected in order to: fulfill the reservation; determine eligibility for special or promotional rates; properly attribute reservations to travel agents; and are shared with Hilton's Third-Party Partner. The attribution purpose is a commercial one: the agent's identity credits the booking.

Supporting quotations

Travel agent name and number

We collect this information in order to:

Fulfill your reservation

Determine your eligibility for special or promotional rates

Properly attribute reservations to travel agents

Share this information with Hilton’s Third-Party Partner

Qualifications & exceptions

• The sharing line names the recipient for this category.

Data Access & Collection · Company practice

Point of collection, reservation: airline partner name and number

In the reservation list, the airline partner's name and number are collected in order to credit Points to the guest if they participate in an airline loyalty program, and are shared with Hilton's Third-Party Partner. This is the only stated purpose for the category in the reservation notice.

Supporting quotations

Airline partner name and number

We collect this information in order to:

Credit Points to you if you participate in an airline loyalty program

Share this information with Hilton’s Third-Party Partner

Qualifications & exceptions

• The Points crediting purpose applies only where the guest participates in an airline loyalty program.
• The sharing line names the recipient for this category.

Data Access & Collection · Company practice

Point of collection: what is collected when you enroll in Hilton Honors

The notice states that when a person enrolls in Hilton Honors, Hilton collects the following categories of personal information about them, which are used for the following purposes. The categories listed are name, phone and fax numbers, address, email address, preferred language, payment card information, room preference, corporate name and number, travel agent name and number, airline partner name and number, MyWay preferences, email subscription preferences and opt-out preferences.

Supporting quotations

Enrolling in Hilton Honors

When you enroll in Hilton Honors, we collect the following categories of personal information about you, which are used for the following purposes:

Qualifications & exceptions

• This is the point-of-collection list for enrolment; the same document's general collection summary is the retrospective 12-month list.

Data Access & Collection · Company practice

Point of collection, enrolment: name, its purposes and sharing

In the enrolment list, the name is collected in order to: administer the member's membership in the Hilton Honors loyalty program; verify the Hilton Honors account; send communications relating to Hilton Honors; send marketing communications; perform analytics that provide guests with personalized offers and content; perform analytics that improve business operations; determine eligibility for special or promotional rates; process payments; process transactions with Hilton Honors affiliated partners such as Points.com and Lyft; and detect and prevent fraud. The information is shared with Hilton's Third-Party Partner, and the remaining purposes are administering contests and sweepstakes and optimizing Hilton's websites and mobile apps.

Supporting quotations

Name

We collect this information in order to:

Administer your membership in the Hilton Honors loyalty program

Verify your Hilton Honors account

Send you communications relating to Hilton Honors

Send you marketing communications

Perform analytics to provide guests with personalized offers and content

Perform analytics to improve business operations

Determine your eligibility for special or promotional rates

Process payments

Process transactions with Hilton Honors affiliated partners (such as Points.com and Lyft)

Share this information with Hilton's Third-Party Partner

Administer contests and sweepstakes

Optimize our websites and mobile apps

Detect and prevent fraud

Qualifications & exceptions

• Affiliate partner transactions are named as a purpose, with Points.com and Lyft given as examples.
• The sharing line names the recipient for this category.

Data Access & Collection · Company practice

Point of collection, enrolment: phone and fax numbers

In the enrolment list, phone and fax numbers are collected in order to: administer the member's membership in the Hilton Honors loyalty program; verify the Hilton Honors account; send text messages relating to check-in and any services needed during the stay; authenticate a mobile account; send service-related SMS communications; provide customer service and support; perform analytics that provide personalized offers and content; perform analytics that improve business operations; process transactions with partners; and detect and preventing fraud. The information is shared with Hilton's Third-Party Partner, and the last stated purpose is engaging in sales activity for group bookings, meetings and events.

Supporting quotations

Phone and fax numbers

We collect this information in order to:

Administer your membership in the Hilton Honors loyalty program

Verify your Hilton Honors account

Send you text messages relating to check-in and any services you may need during your stay

Authenticate mobile account

Send service-related SMS communications

Provide customer service and support

Perform analytics in order to provide you with personalized offers and content

Perform analytics to improve business operations

Process transactions with partners

Share this information with Hilton's Third-Party Partner

Detect and prevent fraud

Engage in sales activity for group bookings, meetings and events

Qualifications & exceptions

• Text messages about check-in and in-stay services are service uses, distinct from the service-related SMS line and from SMS marketing listed elsewhere in this document.
• The sharing line names the recipient for this category.

Data Access & Collection · Company practice

Point of collection, enrolment: address, its purposes and sharing

In the enrolment list, the address is collected in order to: administer the member's membership in the Hilton Honors loyalty program; verify the Hilton Honors account; send communications relating to Hilton Honors; send marketing communications; perform analytics that provide guests with personalized offers and content; perform analytics that improve business operations; determine eligibility for special or promotional rates; process payments; process transactions with partners; and detect and prevent fraud. The information is shared with Hilton's Third-Party Partner, and the last stated purpose is engaging in sales activity for group bookings, meetings and events.

Supporting quotations

Address

We collect this information in order to:

Administer your membership in the Hilton Honors loyalty program

Verify your Hilton Honors account

Send you communications relating to Hilton Honors

Send you marketing communications

Perform analytics to provide guests with personalized offers and content

Perform analytics to improve business operations

Determine your eligibility for special or promotional rates

Process payments

Process transactions with partners

Share this information with Hilton’s Third-Party Partner

Detect and prevent fraud

Engage in sales activity for group bookings, meetings, and events

Qualifications & exceptions

• The sharing line names the recipient for this category.

Data Access & Collection · Company practice

Point of collection, enrolment: email address, first purposes

In the enrolment list, the email address is collected in order to: administer the member's membership in the Hilton Honors loyalty program; verify the member's Hilton Honors account and reservation; and associate the reservation with the member's Hilton Honors account. The remaining purposes of this category are set out in the next part of the list.

Supporting quotations

Email address

We collect this information in order to:

Administer your membership in the Hilton Honors loyalty program

Verify your Hilton Honors account and reservation

Associate your reservation with your Hilton Honors account

Qualifications & exceptions

• Only the first purposes of this category are stated in this part of the list.

Data Access & Collection · Company practice

Point of collection, enrolment: email address — remaining purposes and sharing

The remaining stated purposes for the email address in the enrolment list are: sending communications relating to Hilton Honors; sending marketing communications; performing analytics that provide personalized offers and content; performing analytics that improve business operations; determining eligibility for special or promotional rates; and processing transactions with partners. The information is shared with Hilton's Third-Party Partner, and the further purposes are detecting and preventing fraud, authenticating a mobile account, and engaging in sales activity for group bookings, meetings and events.

Supporting quotations

Send you communications relating to Hilton Honors

Send you marketing communications

Perform analytics in order to provide you with personalized offers and content

Perform analytics to improve business operations

Determine your eligibility for special or promotional rates

Process transactions with partners

Share this information with Hilton's Third-Party Partner

Detect and prevent fraud

Authenticate mobile account

Engage in sales activity for group bookings, meetings and events

Qualifications & exceptions

• The sharing line names the recipient for this category.

Data Access & Collection · Company practice

Point of collection, enrolment: preferred language

In the enrolment list, the preferred language is collected in order to: provide a superior guest experience; send communications relating to Hilton Honors; send marketing communications; perform analytics that provide personalized offers and content; and is shared with Hilton Principal, Hilton's Third-Party Partner, Hilton Partner Accommodations and Hilton's Third-Party Operator. Unlike the reservation list, the enrolment entry names four recipients for sharing.

Supporting quotations

Preferred language

We collect this information in order to:

Provide you with a superior guest experience

Send you communications relating to Hilton Honors

Send you marketing communications

Perform analytics in order to provide you with personalized offers and content

Share this information with Hilton Principal, Hilton’s Third-Party Partner, Hilton Partner Accommodations, and Hilton’s Third-Party Operator

Qualifications & exceptions

• The sharing line names the recipients for this category.

Data Access & Collection · Company practice

Point of collection, enrolment: payment card information

In the enrolment list, payment card information is collected in order to process payments, and it is shared with Hilton Principal, Hilton Partner Accommodations and Hilton's Third-Party Operator. The further stated purpose is detecting and preventing fraud. The Statement does not list a marketing or analytics purpose for card data in this entry.

Supporting quotations

Payment card information

We collect this information in order to:

Process payments

Share this information with Hilton Principal, Hilton Partner Accommodations, and Hilton’s Third-Party Operator

Detect and prevent fraud

Qualifications & exceptions

• The sharing line names the recipients for this category.

Data Access & Collection · Company practice

Point of collection, enrolment: room preference

In the enrolment list, the room preference is collected in order to: fulfill the reservation; personalize the experience; perform analytics that provide personalized offers and content; perform analytics that improve business operations; and is shared with Hilton Principal, Hilton Partner Accommodations and Hilton's Third-Party Operator.

Supporting quotations

Room preference

We collect this information in order to:

Fulfill your reservations

Personalize your experience

Perform analytics to provide you with personalized offers and content

Perform analytics to improve business operations

Share this information with Hilton Principal, Hilton Partner Accommodations, and Hilton’s Third-Party Operator

Qualifications & exceptions

• The sharing line names the recipients for this category.

Data Access & Collection · Company practice

Point of collection, enrolment: corporate name and number

In the enrolment list, the corporate name and number are collected in order to: fulfill the reservation; determine eligibility for special or promotional rates; and are shared with Hilton's Third-Party Partner. No marketing or analytics purpose is listed for this category in the enrolment notice.

Supporting quotations

Corporate name and number

We collect this information in order to:

Fulfill your reservation

Determine your eligibility for special or promotional rates

Share this information with Hilton’s Third-Party Partner

Qualifications & exceptions

• The sharing line names the recipient for this category.

Data Access & Collection · Company practice

Point of collection, enrolment: travel agent name and number

In the enrolment list, the travel agent's name and number are collected in order to: fulfill the reservation; determine eligibility for special or promotional rates; properly attribute reservations to travel agents; and are shared with Hilton's Third-Party Partner.

Supporting quotations

Travel agent name and number

We collect this information in order to:

Fulfill your reservation

Determine your eligibility for special or promotional rates

Properly attribute reservations to travel agents

Share this information with Hilton’s Third-Party Partner

Qualifications & exceptions

• The sharing line names the recipient for this category.

Data Access & Collection · Company practice

Point of collection, enrolment: airline partner name and number

In the enrolment list, the airline partner's name and number are collected in order to credit Points to the member if they participate in an airline loyalty program, and are shared with Hilton's Third-Party Partner. This is the only stated purpose for the category in the enrolment notice.

Supporting quotations

Airline partner name and number

We collect this information in order to:

Credit Points to you if you participate in an airline loyalty program

Share this information with Hilton’s Third-Party Partner

Qualifications & exceptions

• The Points crediting purpose applies only where the member participates in an airline loyalty program.
• The sharing line names the recipient for this category.

Data Access & Collection · Company practice

Point of collection, enrolment: MyWay preferences

In the enrolment list, the member's MyWay preferences are collected in order to provide a superior guest experience, and are shared with Hilton's Third-Party Partner. The guest experience is the only stated purpose for this category in the enrolment notice.

Supporting quotations

MyWay preferences

We collect this information in order to:

Provide you with a superior guest experience

Share this information with Hilton’s Third-Party Partner

Qualifications & exceptions

• The sharing line names the recipient for this category.

Data Access & Collection · Company practice

Point of collection, enrolment: email subscription preferences

In the enrolment list, email subscription preferences are collected in order to send the communications the member would like to receive. No sharing line is stated for this category in the enrolment notice.

Supporting quotations

Email subscription preferences

We collect this information in order to:

Send you the communications you would like to receive

Qualifications & exceptions

• The stated purpose is sending requested communications, which is distinct from marketing communications listed for other categories.

Data Access & Collection · Company practice

Point of collection, enrolment: opt-out preferences

In the enrolment list, opt-out preferences are collected in order to send the communications the member would like to receive and to better serve guests. The category records the member's opt-out choices; the Statement's marketing choices section describes how those choices are exercised and withdrawn.

Supporting quotations

Opt-out preferences

We collect this information in order to:

Send you the communications you would like to receive

Better serve our guests

Qualifications & exceptions

• The two stated purposes are the sending of requested communications and serving guests; no sharing line is stated for this category in the enrolment notice.

Data Access & Collection · Company practice

Point of collection: what may be collected when you check in at a Hilton property

The notice says that when a guest checks in at a Hilton property, Hilton may collect the following categories of personal information about them, which are used for the following purposes. The word used is 'may', so the collection at check-in is conditional. The categories listed are name, payment card information, additional guest names, passport or ID information, address, nationality and further items that follow in the next part of the section.

Supporting quotations

Checking in at a Hilton Property

When you check in at a Hilton property, we may collect the following categories of personal information about you, which are used for the following purposes:

Qualifications & exceptions

• The check-in notice says Hilton 'may' collect these categories, so collection at check-in is not stated as automatic.
• The remaining categories of the list follow in the next part of the section.

Data Access & Collection · Company practice

Point of collection, check-in: name and its purposes

In the check-in list, the guest's name is collected in order to: look up and verify the reservation; fulfill the reservation; provide customer service and support; and detect and prevent fraud. No marketing or analytics purpose is stated for the name in this entry.

Supporting quotations

Name

We collect this information in order to:

Look up and verify your reservation

Fulfill your reservation

Provide customer service and support

Detect and prevent fraud

Data Access & Collection · Company practice

Point of collection, check-in: payment card information

In the check-in list, payment card information is collected in order to process payments, and it is shared with Hilton Principal, Hilton Partner Accommodations and Hilton's Third-Party Operator. The further stated purpose is detecting and preventing fraud.

Supporting quotations

Payment card information

We collect this information in order to:

Process payments

Share this information with Hilton Principal, Hilton Partner Accommodations, and Hilton’s Third-Party Operator

Detect and prevent fraud

Qualifications & exceptions

• The sharing line names the recipients for this category.

Data Access & Collection · Company practice

Point of collection, check-in: additional guest names

In the check-in list, additional guest names are collected in order to fulfill the reservation. These are the names of other people on the booking, so the collection concerns other individuals as well as the guest checking in. No sharing line is stated for this category.

Supporting quotations

Additional guest names

We collect this information in order to:

Fulfill your reservation

Data Access & Collection · Company practice

Point of collection, check-in: passport or ID information

In the check-in list, passport or ID information is collected in order to comply with applicable laws that require Hilton to collect this information in some jurisdictions. The legal trigger is global and qualified by 'some jurisdictions'; the Statement does not name the countries or the law. No sharing line is stated for this category in the check-in list.

Supporting quotations

Passport or ID information

We collect this information in order to:

Comply with applicable laws that require us to collect this information in some jurisdictions

Qualifications & exceptions

• The stated basis is a legal requirement 'in some jurisdictions', not a Hilton service purpose.
• The Statement does not name the specific laws or jurisdictions in this entry.

Data Access & Collection · Company practice

Point of collection, check-in: address, its purposes and sharing

In the check-in list, the address is collected in order to: comply with applicable laws that require the collection in some jurisdictions; verify the Hilton Honors account; fulfill the reservation; send communications relating to the reservation; send marketing communications; perform analytics that provide guests with personalized offers and content; perform analytics that improve business operations; process payments; process transactions with partners; and detect and prevent fraud. The information is shared with Hilton Principal, Hilton's Third-Party Partner and Hilton's Third-Party Operator.

Supporting quotations

Address

We collect this information in order to:

Comply with applicable laws that require us to collect this information in some jurisdictions

Verify your Hilton Honors account

Fulfill your reservation

Send you communications relating to your reservation

Send you marketing communications

Perform analytics to provide guests with personalized offers and content

Perform analytics to improve business operations

Process payments

Process transactions with partners

Share this information with Hilton Principal, Hilton’s Third-Party Partner, and Hilton’s Third-Party Operator

Detect and prevent fraud

Qualifications & exceptions

• One stated purpose is a legal requirement 'in some jurisdictions', alongside the service and marketing purposes.
• The sharing line names the recipients for this category.

Data Access & Collection · Company practice

Point of collection, check-in: nationality collected for legal compliance

In the check-in list, nationality is collected in order to comply with applicable laws that require Hilton to collect this information in some jurisdictions. This is the first stated purpose for the category; the remaining purposes and any sharing line follow in the next part of the section.

Supporting quotations

Nationality

We collect this information in order to:

Comply with applicable laws that require us to collect this information in some jurisdictions

Qualifications & exceptions

• The stated basis is a legal requirement 'in some jurisdictions'.
• Only the first purpose of this category is stated in this part of the list.

Data Access & Collection · Company practice

Point of collection, check-in: date of birth collected for legal compliance

In the check-in list, date of birth is collected in order to comply with applicable laws that require Hilton to collect this information in some jurisdictions. The legal trigger is qualified by 'some jurisdictions'; the Statement does not name the specific laws here.

Supporting quotations

Date of birth

We collect this information in order to:

Comply with applicable laws that require us to collect this information in some jurisdictions

Qualifications & exceptions

• The stated basis is a legal requirement 'in some jurisdictions', not a Hilton service purpose.
• Only the first purpose of this category is stated in this part of the list.

Data Access & Collection · Company practice

Point of collection, check-in: gender collected for legal compliance

In the check-in list, gender is collected in order to comply with applicable laws that require Hilton to collect this information in some jurisdictions. The legal trigger is qualified by 'some jurisdictions'; the Statement does not name the specific laws here.

Supporting quotations

Gender

We collect this information in order to:

Comply with applicable laws that require us to collect this information in some jurisdictions

Qualifications & exceptions

• The stated basis is a legal requirement 'in some jurisdictions', not a Hilton service purpose.
• Only the first purpose of this category is stated in this part of the list.

Data Access & Collection · Company practice

Point of collection, check-in: Hilton Honors number and its purposes

In the check-in list, the Hilton Honors number is collected in order to: look up and verify the member's Hilton Honors account and reservation; administer the member's Hilton Honors membership; support marketing efforts; provide customer service and support; fulfill guest reservations; send guests communications relating to their reservations; send marketing communications by email, direct mail and social media; perform analytics that provide guests with personalized offers and content; perform analytics that improve business operations; determine guests' eligibility for special or promotional rates; process payments; and process transactions with partners. The remaining purposes of this category are set out in the next part of the list.

Supporting quotations

Hilton Honors number

We collect this personal information in order to:

Look up and verify your Hilton Honors account and reservation

Administer your membership in Hilton Honors

Support marketing efforts

Provide customer service and support

Fulfill guest reservations

Send guests communications relating to their reservations

Send marketing communications via email, direct mail, and social media

Perform analytics in order to provide guests with personalized offers and content

Perform analytics to improve business operations

Determine guests’ eligibility for special or promotional rates

Process payments

Qualifications & exceptions

• Marketing and marketing communications are stated purposes of collecting the loyalty number at check-in.
• Only the first purposes of this category are stated in this part of the list.

Data Access & Collection · Company practice

Point of collection, check-in: Hilton Honors number — remaining purposes and sharing

The remaining stated purposes for the Hilton Honors number in the check-in list are processing transactions with partners, administering contests and sweepstakes, and detecting and preventing fraud. The information is shared with Hilton Principal, Hilton's Third-Party Partner and Hilton's Third-Party Operator.

Supporting quotations

Process transactions with partners

Administer contests and sweepstakes

Share this information with Hilton Principal, Hilton’s Third-Party Partner, and Hilton’s Third-Party Operator

Detect and prevent fraud

Qualifications & exceptions

• The sharing line names the recipients for this category.

Data Access & Collection · Company practice

Point of collection, check-in: frequent flyer number to award loyalty Points

In the check-in list, the frequent flyer number is collected in order to facilitate the award of loyalty Points. That is the only stated purpose for the category in the check-in notice.

Supporting quotations

Frequent flyer number

We collect this information in order to:

Facilitate the award of loyalty Points

Data Access & Collection · Company practice

Point of collection, check-in: email address, its purposes and sharing

In the check-in list, the email address is collected in order to: send folios after the completion of a stay; associate the reservation with the member's Hilton Honors account; send marketing communications; perform analytics that provide personalized offers and content; perform analytics that improve business operations; determine eligibility for special or promotional rates; and process transactions with partners. The information is shared with Hilton Principal, Hilton's Third-Party Partner and Hilton's Third-Party Operator, and the further purposes are detecting and preventing fraud, authenticating a mobile account, and engaging in sales activity for group bookings, meetings and events.

Supporting quotations

Email address

We collect this information in order to:

Send folios after the completion of a stay

Associate your reservation with your Hilton Honors account

Send you marketing communications

Perform analytics in order to provide you with personalized offers and content

Perform analytics to improve business operations

Determine your eligibility for special or promotional rates

Process transactions with partners

Share this information with Hilton Principal, Hilton’s Third-Party Partner, and Hilton’s Third-Party Operator

Detect and prevent fraud

Authenticate mobile account

Engage in sales activity for group bookings, meetings and events

Qualifications & exceptions

• Sending folios after the stay is a service use, distinct from the marketing and analytics purposes listed alongside it.
• The sharing line names the recipients for this category.

Data Access & Collection · Company practice

Point of collection: what is collected when you check in using e-check-in

The notice says that when a guest checks in using e-check-in, Hilton collects the following categories of personal information about them, which are used for the following purposes. The categories listed are payment card information, room selection and assignment, arrival time and departure date. E-check-in is a self-service check-in route, so the same stay-related data is collected without the front desk.

Supporting quotations

E-Check In

When you check in using e-check-in, we collect the following categories of personal information about you, which are used for the following purposes:

Qualifications & exceptions

• The notice says Hilton 'collects', not 'may collect', for e-check-in; the check-in notice itself says 'may collect'.
• The remaining categories of the list, if any, follow in the next part of the section.

Data Access & Collection · Company practice

Point of collection, e-check-in: payment card information

In the e-check-in list, payment card information is collected in order to: receive payment for the reservation; detect and prevent fraud; and maintain books and records and comply with legal obligations for business reporting, auditing, tax and income reconciliation. No sharing line is stated for this category in the e-check-in list.

Supporting quotations

Payment card information

We collect this information in order to:

Receive payment for your reservation

Detect and prevent fraud

Maintain books and records and comply with legal obligations for business reporting, auditing, tax, and income reconciliation

Qualifications & exceptions

• The record-keeping purpose is tied to legal obligations for business reporting, auditing, tax and income reconciliation.

Data Access & Collection · Company practice

Point of collection, e-check-in: room selection and assignment

In the e-check-in list, room selection and assignment is collected in order to fulfill the reservation and to better serve guests. These are the only stated purposes for the category in the e-check-in notice.

Supporting quotations

Room selection and assignment

We collect this information in order to:

Fulfill your reservation

Better serve our guests

Data Access & Collection · Company practice

Point of collection, e-check-in: arrival time

In the e-check-in list, arrival time is collected in order to: better serve guests; fulfill the reservation; personalize the experience; and provide customer service and support. No sharing line is stated for this category in the e-check-in list.

Supporting quotations

Arrival time

We collect this information in order to:

Better serve our guests

Fulfill your reservation

Personalize your experience

Provide customer service and support

Data Access & Collection · Company practice

Point of collection, e-check-in: departure date

In the e-check-in list, departure date is collected in order to: better serve guests; fulfill the reservation; personalize the experience; and provide customer service and support. No sharing line is stated for this category in the e-check-in list.

Supporting quotations

Departure date

We collect this information in order to:

Better serve our guests

Fulfill your reservations

Personalize your experience

Provide customer service and support

Data Access & Collection · Company practice

Point of collection: what is collected when you use Digital Key

The notice says that when a guest uses Digital Key, Hilton collects the following categories of personal information about them, which are used for the following purposes. The categories listed are payment card information, room selection and assignment, arrival time, departure date and precise geolocation information. Digital Key is the phone-based room access feature, and its notice adds precise geolocation to the stay categories.

Supporting quotations

Digital Key

When you use Digital Key, we collect the following categories of personal information about you, which are used for the following purposes:

Qualifications & exceptions

• Digital Key use is what triggers the collection described here.
• The remaining categories of the list follow in the next part of the section.

Data Access & Collection · Company practice

Point of collection, Digital Key: payment card information

In the Digital Key list, payment card information is collected in order to: receive payment for the reservation; detect and prevent fraud; and maintain books and records and comply with legal obligations for business reporting, auditing, tax and income reconciliation. No sharing line is stated for this category in the Digital Key list.

Supporting quotations

Payment card information

We collect this information in order to:

Receive payment for your reservation

Detect and prevent fraud

Maintain books and records and comply with legal obligations for business reporting, auditing, tax, and income reconciliation

Qualifications & exceptions

• The record-keeping purpose is tied to legal obligations for business reporting, auditing, tax and income reconciliation.

Data Access & Collection · Company practice

Point of collection, Digital Key: room selection and assignment

In the Digital Key list, room selection and assignment is collected in order to fulfill the reservation and to better serve guests. These are the only stated purposes for the category in the Digital Key notice.

Supporting quotations

Room selection and assignment

We collect this information in order to:

Fulfill your reservation

Better serve our guests

Data Access & Collection · Company practice

Point of collection, Digital Key: arrival time

In the Digital Key list, arrival time is collected in order to: better serve guests; fulfill the reservation; personalize the experience; and provide customer service and support. No sharing line is stated for this category in the Digital Key list.

Supporting quotations

Arrival time

We collect this information in order to:

Better serve our guests

Fulfill your reservation

Personalize your experience

Provide customer service and support

Data Access & Collection · Company practice

Point of collection, Digital Key: departure date

In the Digital Key list, departure date is collected in order to: better serve guests; fulfill the reservation; personalize the experience; and provide customer service and support. No sharing line is stated for this category in the Digital Key list.

Supporting quotations

Departure date

We collect this information in order to:

Better serve our guests

Fulfill your reservations

Personalize your experience

Provide customer service and support

Data Access & Collection · Company practice

Point of collection, Digital Key: precise geolocation information

In the Digital Key list, precise geolocation information is collected in order to: enable the guest to access the guest room and hotel facilities; fulfill Digital Key sharing requests; and detect and prevent fraud. This is the only category in the point-of-collection notices described as 'precise geolocation information'.

Supporting quotations

Precise geolocation information

We collect this information in order to:

Enable you to access your guest room and hotel facilities

Fulfill Digital Key sharing requests

Detect and prevent fraud

Qualifications & exceptions

• The category is stated in the Digital Key notice only; the general collection summary has a separate 'Geolocation information' category collected from browsing and app use.
• No sharing line is stated for this category in the Digital Key list.

Data Access & Collection · Company practice

Point of collection: what is collected when you contact Guest Assistance

The notice says that when a person contacts Guest Assistance, Hilton collects the following categories of personal information about them, which are used for the following purposes. The first category is complaint descriptions, with purposes that follow in the next part of the section. The categories after that are name, address, email address, phone and fax numbers, as the section shows.

Supporting quotations

Guest Assistance

When you contact Guest Assistance, we collect the following categories of personal information about you, which are used for the following purposes:

Qualifications & exceptions

• This notice covers contact with Guest Assistance, not the general customer service channels.

Data Access & Collection · Company practice

Point of collection, Guest Assistance: complaint descriptions

In the Guest Assistance list, complaint descriptions are collected in order to: respond to the complaint or injury; perform analytics to improve business operations; and provide customer service and support. The remaining purposes of this category, and any sharing line, follow in the next part of the section.

Supporting quotations

Complaint descriptions

We collect this information in order to:

Respond to your complaint or injury

Perform analytics to improve business operations

Provide customer service and support

Qualifications & exceptions

• The purposes cover both complaints and injuries reported through Guest Assistance.
• Only the first purposes of this category are stated in this part of the list.

Data Access & Collection · Company practice

Point of collection, Guest Assistance: name, identity verification and record search

In the Guest Assistance list, the name is collected in order to: look up and verify identity; search Hilton's records for information about past stays and membership in the Hilton Honors loyalty program; provide customer service recovery and support; and detect and prevent fraud. The record-search purpose means the name is used to pull the person's history with Hilton, not only to answer the current request. No sharing line is stated for this category in the Guest Assistance notice.

Supporting quotations

Name

We collect this information in order to:

Look up and verify your identity

Search our records for information about your past stays and membership in the Hilton Honors loyalty program

Provide customer service recovery and support

Detect and prevent fraud

Qualifications & exceptions

• The sharing grounds are qualified: law enforcement, employer sharing on corporate agreements and employee consent, and franchise owners only where the incident relates to their property.

Data Access & Collection · Company practice

Point of collection, Guest Assistance: address

In the Guest Assistance list, the address is collected in order to: verify identity; provide customer service and support; and detect and prevent fraud. No sharing line is stated for this category in the Guest Assistance notice.

Supporting quotations

Address

We collect this information in order to:

Verify your identity

Provide customer service and support

Detect and prevent fraud

Data Access & Collection · Company practice

Point of collection, Guest Assistance: email address

In the Guest Assistance list, the email address is collected in order to: verify identity; provide follow-up communications regarding the inquiry; perform analytics to improve business operations; detect and prevent fraud; provide customer service and support; and authenticate a mobile account. No sharing line is stated for this category in the Guest Assistance notice.

Supporting quotations

Email address

We collect this information in order to:

Verify your identity

Provide follow-up communications regarding your inquiry

Perform analytics to improve business operations

Detect and prevent fraud

Provide customer service and support

Authenticate mobile account

Data Access & Collection · Company practice

Point of collection, Guest Assistance: phone and fax numbers

In the Guest Assistance list, phone and fax numbers are collected in order to: verify identity; provide follow-up communications regarding the inquiry; authenticate a mobile account; send service-related SMS communications; provide customer service and support; and detect and prevent fraud. No sharing line is stated for this category in the Guest Assistance notice.

Supporting quotations

Phone and fax numbers

We collect this information in order to:

Verify your identity

Provide follow-up communications regarding your inquiry

Authenticate mobile account

Send service-related SMS communications

Provide customer service and support

Detect and prevent fraud

Data Access & Collection · Restriction or exception

Minors: no knowing collection below the age of majority without parental permission, and ages of minor guests for rates

Hilton states that it does not knowingly collect, disclose or sell personal information of individuals under the age of majority in their respective jurisdiction without permission from a minor's parent or guardian, and that it verifies parental or guardian consent using industry-standard methods before collecting, processing or storing a minor's personal information. It adds that when searching for hotel reservations on a Hilton website or in the Hilton Honors app, a guest may be asked for the ages of minor guests staying in the room, and that Hilton collects this to determine room rates where applicable, such as at an all-inclusive property. The age of majority is therefore jurisdictional, and the age-of-guests collection is a specific rate-determination use.

Supporting quotations

Minors

Hilton does not knowingly collect, disclose, or sell personal information of individuals under the age of majority in their respective jurisdiction without permission from a minor’s parent or guardian.

We verify parental or guardian consent using industry-standard methods prior to collecting, processing, or storing personal information of minors.

Hilton collects this information for the purpose of determining room rates where applicable, such as at an “all-inclusive” property.

Qualifications & exceptions

• The age threshold is 'the age of majority in their respective jurisdiction', so it differs by country and is not a single stated age.
• The consent verification is described as using industry-standard methods; the Statement does not name them.
• The ages of minor guests are requested to determine room rates where applicable, for example at an all-inclusive property.

Data Access & Collection · Company practice

Cookies and Other Technologies: what they are, what they are used for, and consent for non-essential cookies

Hilton says that, like many other websites, its site may use 'Cookies' or 'Other Technologies' — pixel tags, web beacons, clear GIFs, links in emails, JavaScript, device IDs assigned by Google or Apple or similar technologies — which allow Hilton and third parties to obtain information about visits to the site, including to analyse visiting patterns. Hilton uses this information to process reservations or requests and to deliver online and mobile advertisements, messages and content for Hilton and others that are specific to the visitor's interests. Depending on the jurisdiction, prior consent for the use of non-essential cookies may be required, and if it is, Hilton says it will obtain consent before using cookies on the device. Cookies are small text files stored on the visitor's computer or mobile device; a cookie alone cannot disclose individual identity, though Hilton may tie its own or third-party cookies to personal information it holds or has otherwise obtained.

Supporting quotations

3. Online and Mobile Information We Collect

Cookies and Other Technologies

our site may use "Cookies" or "Other Technologies"

Depending on your jurisdiction, prior consent for the use of non-essential cookies may be required.

Cookies are small text files that are stored on your computer or mobile device

Cookies alone cannot be used to disclose your individual identity to us, though in some cases we may tie Hilton or third-party Cookies to personal information you have provided to us or that we have otherwise obtained about you.

Qualifications & exceptions

• 'May use' states a possibility, not that every technology is used on every visit.
• The consent requirement is qualified by 'depending on your jurisdiction' and applies to non-essential cookies.
• Cookies alone cannot disclose identity, but they may be linked to personal information Hilton already holds.

Data Access & Collection · Company practice

Analytics cookies and other technologies used for the same purposes

Analytics Cookies collect information about use of the site and enable Hilton to improve the way it works: they give Hilton aggregated information used to monitor site performance, count page visits, spot technical errors, see how users reach the site, and measure the effectiveness of advertising, including emails. Hilton also says other technologies may be used for the same purposes as its cookies, to allow Hilton and third parties to know when a visitor comes to the site and to understand how the visitor interacts with emails or advertisements; through these technologies, non-personal information such as operating system, browser version and the URL the visitor came from, or aggregate information, may be obtained and used to enhance the experience and understand traffic patterns.

Supporting quotations

Analytics Cookies – Collect information about your use of the site, and enable us to improve the way it works.

These Cookies give us aggregated information that we use to monitor site performance, count page visits, spot technical errors, see how users reach the site, and measure the effectiveness of advertising (including emails we send to you).

Other technologies may be used for the same purposes as our Cookies, to allow us and third parties to know when you visit the site, and to understand how you interact with emails or advertisements.

Through Other Technologies, non-personal information (e.g., your operating system, your browser version, and the URL you came from) or aggregate information may be obtained and used to enhance your experience and understand traffic patterns.

Qualifications & exceptions

• The analytics cookies described give aggregated information.
• Other technologies are described as yielding non-personal or aggregate information in the examples given.

Data Access & Collection · Context

China: the main body's collection section is incorporated, plus additional categories shared with third parties

The China appendix says that for the types of personal information collected, and for how Hilton collects and uses personal information, the purposes of use and the sharing or disclosure of personal information, readers should refer to the Personal Information We Collect section of the main body. It then adds that in addition to the information given in that section, Hilton may collect, process or share the personal information listed in the appendix with third parties for the purposes set out there. The list that follows is the China-specific addition to the main body's disclosure list.

Supporting quotations

2. Collection and Use of Personal Information

Regarding the following issues, please refer to the Personal Information We Collect

The types of personal information that we collect from you (including sensitive personal information)

How we collect and use your personal information, the purposes for which we use it, and how we share or disclose your personal information.

In addition to the information provided in the Personal Information We Collect section of this Statement, we may collect, process, or share the following personal information with third parties for the purposes set out below:

Qualifications & exceptions

• The main body's collection section is the stated source for the types of information and the purposes of use.
• The China list is stated as an addition to, not a replacement for, the main body.

Data Access & Collection · Company practice

China: gender — source, purpose and sharing

In the China appendix's list, gender is obtained directly from consumers themselves, collected for the business or commercial purpose of providing customer service, and shared with government agencies pursuant to legal requirements in some countries. The list gives no sale status for this category.

Supporting quotations

Gender

We have obtained this personal information from the following sources

Directly from consumers themselves

We collected this personal information for the following business or commercial purposes

Provide customer service

We have shared this personal information with the following categories of third parties

Government agencies pursuant to legal requirements in some countries

Qualifications & exceptions

• The government-agency sharing is qualified by legal requirements in some countries.

Data Access & Collection · Company practice

China: telephone — sources of collection

In the China appendix's list, the telephone number is obtained from three sources: directly from consumers themselves, from third parties such as travel booking platforms and credit card providers, and from demographics companies. The purposes and sharing for this category follow in the next part of the appendix.

Supporting quotations

Telephone

We have obtained this personal information from the following sources

Directly from consumers themselves

From third parties such as travel booking platforms and credit card providers

From demographics companies

Qualifications & exceptions

• Only the sources of this category are stated in this part; the purposes and sharing follow in the next part.

Data Access & Collection · Company practice

China: telephone — purposes and third-party sharing

In the China appendix's list, the telephone number is collected for the business or commercial purposes of executing marketing communications and performing analytics to provide guests with personalized offers and content, and is shared with service providers who perform tasks on behalf of Hilton, which may include those who send marketing communications on its behalf, with Hilton's Third-Party Partner, with employers pursuant to corporate agreements, employee consent and as permitted by law, with the third-party travel booking platform or travel agent through which the guest made a reservation, with third-party advertisers for optimization and personalization on their platforms, with Hilton's Third-Party Operator and with Hilton Principal.

Supporting quotations

We collected this personal information for the following business or commercial purposes

Executing marketing communications

Perform analytics to provide guests with personalized offers and content

We have shared this personal information with the following categories of third parties

Service providers who perform tasks on behalf of Hilton, which may include those who send marketing communications on our behalf

Hilton's Third-Party Partner

Employers pursuant to corporate agreements, employee consent, and as permitted by law

The third-party travel booking platform or travel agent through which a guest made a reservation

Third-party advertisers, for optimization and personalization on their platforms

Hilton's Third-Party Operator

Hilton Principal

Qualifications & exceptions

• Employer sharing is conditional on corporate agreements, employee consent and the law.
• The third-party advertisers entry is qualified to optimization and personalization on their own platforms.

Data Access & Collection · Company practice

China: arrival time — source and purposes

In the China appendix's list, the arrival time is obtained directly from consumers themselves, and collected for the business or commercial purposes of better serving guests, fulfilling reservations, personalizing the guest experience and providing customer service and support. The sharing for this category is set out in the next part of the appendix.

Supporting quotations

Arrival Time

We have obtained this personal information from the following sources

Directly from consumers themselves

We collected this personal information for the following business or commercial purposes

Better serve our guests

Fulfill reservations

Personalize guest experience

Provide customer service and support

Qualifications & exceptions

• Only the source and purposes are stated in this part; the sharing follows in the next part.

Data Access & Collection · Company practice

China: departure date — source, purposes and sharing

In the China appendix's list, the departure date is obtained directly from consumers themselves, collected for the business or commercial purposes of better serving guests, fulfilling reservations and personalizing the guest experience, and shared with service providers who perform tasks on behalf of Hilton.

Supporting quotations

Departure Date

We have obtained this personal information from the following sources

Directly from consumers themselves

We collected this personal information for the following business or commercial purposes

Better serve our guests

Fulfill reservations

Personalize guest experience

We have shared this personal information with the following categories of third parties

Service providers who perform tasks on behalf of Hilton

Data Access & Collection · Company practice

China: spending amount — source, purposes and sharing

In the China appendix's list, the spending amount is obtained directly from consumers themselves, collected for the business or commercial purposes of better serving guests, performing analytics to improve business operations, supporting marketing efforts, and fulfilling obligations for business reporting, auditing, tax and income reconciliation, and shared with service providers who perform tasks on behalf of Hilton.

Supporting quotations

Spending Amount

We have obtained this personal information from the following sources

Directly from consumers themselves

We collected this personal information for the following business or commercial purposes

Better serve our guests

Perform analytics to improve business operations

Support marketing efforts

Fulfill obligations for business reporting, auditing, tax, and income reconciliation

We have shared this personal information with the following categories of third parties

Service providers who perform tasks on behalf of Hilton

Data Access & Collection · Company practice

China: WeChat Union ID — source, purpose and sharing

In the China appendix's list, the WeChat Union ID is obtained directly from consumers themselves, collected for the business or commercial purpose of performing analytics to provide guests with personalized offers and content, and shared with service providers who perform tasks on behalf of Hilton and with Hilton's Third-Party Partners.

Supporting quotations

WeChat Union ID

We have obtained this personal information from the following sources

Directly from consumers themselves

We collected this personal information for the following business or commercial purposes

Perform analytics to provide guests with personalized offers and content

We have shared this personal information with the following categories of third parties

Service providers who perform tasks on behalf of Hilton

Hilton’s Third-Party Partners

Data Access & Collection · Company practice

China: WeChat Open ID — source, purpose and sharing

In the China appendix's list, the WeChat Open ID is obtained directly from consumers themselves, collected for the business or commercial purpose of performing analytics to provide guests with personalized offers and content, and shared with service providers who perform tasks on behalf of Hilton. Unlike the WeChat Union ID category, no Third-Party Partner is named as a recipient here.

Supporting quotations

WeChat Open ID

We have obtained this personal information from the following sources

Directly from consumers themselves

We collected this personal information for the following business or commercial purposes

Perform analytics to provide guests with personalized offers and content

We have shared this personal information with the following categories of third parties

Service providers who perform tasks on behalf of Hilton

Data Access & Collection · Company practice

China: third-party SDKs embedded in the applications, with their own privacy policies

The China appendix says that to provide and optimize its services, third-party SDKs are embedded in Hilton's applications, including WeChat Mini Programs, and that it lists the names of the third-party SDKs it currently embeds, the types of personal information collected and the purpose of collection and use. It directs anyone with questions about collection through the SDKs to the third parties' own privacy policies.

Supporting quotations

3.3 Third-Party SDKs:

To provide and optimize our services, third-party SDKs are embedded in our applications (including WeChat Mini Programs).

The following lists the names of the third-party SDKs we currently embed, the types of personal information collected, and the purpose of collection and use.

please refer to the privacy policies of such third parties.

Qualifications & exceptions

• The list covers SDKs Hilton currently embeds.
• The SDKs are embedded in the applications, including WeChat Mini Programs.
• Collection through the SDKs is governed by the third parties' own privacy policies.

Data Access & Collection · Company practice

Third-party SDK: Alipay App Payment

The China appendix lists the Alipay App Payment SDK, provided by Alipay (China) Network Technology Co., Ltd., with the purpose of payment, embedded in the iOS and Android applications. The types of personal information collected by the SDK are listed as common device information: IMEI/IMSI, SIM card serial number or MAC address, android_id for Android devices only, and network information. The appendix links to the SDK's own privacy policy.

Supporting quotations

Alipay "App Payment" SDK

Provider of the SDK

Alipay (China) Network Technology Co., Ltd.

Purposes of the SDK

Payment

Application where the SDK is embedded

iOS, Android

Types of personal information collected by the SDK

Common device information (IMEI/IMSI, SIM card serial number/MAC address, android_id (only for Android devices), network information

Link to the privacy policy of the SDK

https://opendocs.alipay.com/open/01g6qm

Qualifications & exceptions

• The android_id element is collected only for Android devices.
• The SDK is embedded in the iOS and Android applications.

Data Access & Collection · Company practice

Third-party SDK: WeChat Pay

The China appendix lists the WeChat Pay SDK, provided by Tencent, with the purpose of payment, embedded in the iOS and Android applications and in the WeChat Mini-Program. The personal information it collects is the WeChat User OpenId. The appendix links to the SDK's own privacy policy.

Supporting quotations

WeChat Pay

Provider of the SDK

Tencent

Purposes of the SDK

Payment

Application where the SDK is embedded

iOS, Android, WeChat Mini-Program

Types of personal information collected by the SDK

WeChat User OpenId

Link to the privacy policy of the SDK

https://weixin.qq.com/cgi-bin/readtemplate?t=weixin_business_pay

Qualifications & exceptions

• The SDK is embedded in the iOS and Android applications and in the WeChat Mini-Program.

Data Access & Collection · Company practice

Third-party SDK: Adobe Analytics for the WeChat Mini-Program

The China appendix lists the Adobe Analytics SDK for WeChat Mini-Program, provided by Adobe, with the purpose of user clicks and usage records, embedded in the WeChat Mini-Program. The types of personal information collected by the SDK are location information, device information and the version of the operating system. The appendix links to the SDK's own privacy policy.

Supporting quotations

Adobe Analytics SDK for WeChat Mini-Program

Provider of the SDK

Adobe

Purposes of the SDK

User clicks and usage records

Application where the SDK is embedded

WeChat Mini-Program

Types of personal information collected by the SDK

Location information, device information, version of operating system

Link to the privacy policy of the SDK

https://github.com/NJRojas/aep-sdks-documentation/tree/master/resources/adobe-experience-platform-mini-programs-sdk

Qualifications & exceptions

• This SDK is embedded in the WeChat Mini-Program only.

Data Access & Collection · Company practice

Third-party SDK: Adobe Analytics

The China appendix lists the Adobe Analytics SDK, provided by Adobe, with the purpose of user clicks and usage records, embedded in the iOS and Android applications. The types of personal information collected by the SDK are location information, device information and the version of the operating system. The appendix links to the SDK's own privacy policy, which is a document this source does not contain.

Supporting quotations

Adobe Analytics SDK

Provider of the SDK

Adobe

Purposes of the SDK

User clicks and usage records

Application where the SDK is embedded

iOS, Android

Types of personal information collected by the SDK

Location information, device information, version of operating system

Link to the privacy policy of the SDK

https://www.adobe.com/cn/privacy/policy.html

Qualifications & exceptions

• This SDK is embedded in the iOS and Android applications.

Not stated here

• The linked Adobe privacy policy for China is not supplied in this source, so this card cannot say what it requires.

Data Access & Collection · Company practice

Third-party SDK: Baidu Maps

The China appendix lists the Baidu Maps SDK, provided by Baidu, with the purpose of displaying hotels nearby on the map, embedded in the Android application. The types of personal information it collects are set out in the next part of the appendix.

Supporting quotations

Baidu Maps SDK

Provider of the SDK

Baidu

Purposes of the SDK

Displaying hotels nearby on the map

Application where the SDK is embedded

Android

Qualifications & exceptions

• This SDK is embedded in the Android application only.
• Only the provider, purpose and application are stated in this part; the data types follow in the next part.

Data Access & Collection · Company practice

Third-party SDK: Baidu Maps — the data types collected

The China appendix lists the Baidu Maps SDK as embedded in the Android application, and states that it collects geolocation and device environment information: latitude and longitude coordinates, Android ID, GNSS information, Wi-Fi gateway address, BSSID, SSID, Wi-Fi signal strength, Wi-Fi status, Wi-Fi configuration data, available Wi-Fi network information, cellular base station data, mobile carrier information, device signal strength data, IP address, Bluetooth information, and sensor data such as accelerometer, gyroscope, orientation, pressure, rotation vector, ambient light and magnetometer data. The appendix links to the SDK's own privacy policy.

Supporting quotations

Android

Types of personal information collected by the SDK

Geolocation and Device Environment Information, including latitude and longitude coordinates, Android ID, GNSS information, Wi-Fi gateway address, BSSID, SSID, Wi-Fi signal strength, Wi-Fi status, Wi-Fi configuration data, available Wi-Fi network information, cellular base station data, mobile carrier information, device signal strength data, IP address, Bluetooth information, and sensor data (such as accelerometer, gyroscope, orientation, pressure, rotation vector, ambient light, and magnetometer data).

Link to the privacy policy of the SDK

https://lbsyun.baidu.com/index.php?title=open/law

Qualifications & exceptions

• The list of data types is long and includes network, Bluetooth and sensor data, not only location.
• The SDK is embedded in the Android application.

Data Access & Collection · Company practice

Third-party SDK: Google Maps

The China appendix lists the Google Maps SDK, provided by Google, with the purpose of displaying hotels nearby on the map, embedded in the Android application. The personal information it collects is listed as location information for domestic users. The appendix links to the SDK's own privacy policy.

Supporting quotations

Google Maps SDK

Provider of the SDK

Google

Purposes of the SDK

Displaying hotels nearby on the map

Application where the SDK is embedded

Android

Types of personal information collected by the SDK

Location information (domestic users)

Link to the privacy policy of the SDK

https://developers.google.cn/maps/faq?hl=zh-cn#tos_logging

Qualifications & exceptions

• The collected data is stated as location information for domestic users.
• The SDK is embedded in the Android application.

Data Access & Collection · Company practice

Third-party SDK: Workspace one

The China appendix lists the Workspace one SDK, provided by VMWare, with the purpose of recording app crashes and error messages, embedded in the iOS and Android applications. The personal information it collects is listed as device information and the version of the operating system. The appendix links to the SDK's privacy policy, a document this source does not contain.

Supporting quotations

Workspace one

Provider of the SDK

VMWare

Purposes of the SDK

Recording app crashes and error messages

Application where the SDK is embedded

iOS, Android

Types of personal information collected by the SDK

Device information, version of operating system

Link to the privacy policy of the SDK

https://www.broadcom.com/company/legal/privacy

Qualifications & exceptions

• The stated purpose is diagnostic: recording app crashes and error messages.
• The SDK is embedded in the iOS and Android applications.

Not stated here

• The linked Broadcom legal and privacy document is not supplied in this source, so this card cannot say what it requires.

Data Access & Collection · Company practice

Third-party SDK: Xiaomi Push

The China appendix lists the Xiaomi Push SDK, provided by Xiaomi Singapore Pte. Ltd., with the purpose of push notification services, embedded in the Android application. The personal information it collects is listed as the OAID (Open Anonymous Device Identifier) and the encrypted Android ID. The appendix links to the SDK's own privacy policy.

Supporting quotations

Xiaomi Push SDK

Provider of the SDK

Xiaomi Singapore Pte. Ltd.

Purposes of the SDK

Push notification services

Application where the SDK is embedded

Android

Types of personal information collected by the SDK

OAID (Open Anonymous Device Identifier) and encrypted Android ID

Link to the privacy policy of the SDK

https://dev.mi.com/distribute/doc/details?pId=1534

Qualifications & exceptions

• The identifiers collected are the OAID and the encrypted Android ID.
• The SDK is embedded in the Android application.

Data Access & Collection · Company practice

Third-party SDK: OPPO Push

The China appendix lists the OPPO Push SDK, provided by Guangdong Heytap Technology Co., Ltd., with the purpose of push notification services, embedded in the Android application. The types of personal information collected are given at length: device-related information such as IMEI, OAID, serial number, IMSI, user ID, Android ID, Google Advertising ID, device region settings, device model, battery level, operating system version and language settings; application information such as package name, version and running status; the Push SDK version; network-related information such as IP address or domain name connection results and network type; message delivery results; notification status information such as permissions and user interaction data; and lock screen status information. The appendix links to the SDK's own privacy policy.

Supporting quotations

OPPO Push SDK

Provider of the SDK

Guangdong Heytap Technology Co., Ltd.

Purposes of the SDK

Push notification services

Application where the SDK is embedded

Android

Types of personal information collected by the SDK

Device-related information (e.g., IMEI, OAID, serial number, IMSI, user ID, Android ID, Google Advertising ID, device region settings, device model, battery level, operating system version, and language settings); application information (e.g., APP package name, version, and running status); Push SDK version; network-related information (e.g., IP address or domain name connection results, and network type); message delivery results; notification status information (e.g., notification permissions and user interaction data); and lock screen status information (e.g., lock status and lock-screen notification settings).

Link to the privacy policy of the SDK

https://open.oppomobile.com/new/developmentDoc/info?id=10288

Qualifications & exceptions

• The collected categories include advertising and device identifiers, message delivery results and lock-screen status.
• The SDK is embedded in the Android application.

Data Access & Collection · Company practice

Third-party SDK: Geetest Captcha — anti-robot data collected

The China appendix lists the Geetest Captcha SDK, provided by Geetest, with the purpose of anti-robot attack, embedded in the iOS, Android and WeChat Mini Program applications. It sets out five categories of data: device information such as operating system information, manufacturer, model and brand, which after de-identification is used to build abnormal traffic detection models; device network information such as connection status and network type, used after de-identification for abnormal activity and virtual device detection; device environment information such as screen size, battery charging status, battery level, jailbreak or root indicators, debugging indicators and mobile network operator name; user behavioural trajectory information, which it explains refers to interaction trajectory data from the verification process — swipe patterns, click patterns and mouse movement trajectories — rather than page-to-page navigation data, used after de-identification to detect simulated, brute-force and forged interaction trajectories; and other information such as verification timestamps and application package names, used for baseline auxiliary models of abnormal activity detection. The appendix links to the SDK's own privacy policy.

Supporting quotations

Geetest Captcha SDK

Provider of the SDK

Geetest

Purposes of the SDK

Anti-robot attack

Application where the SDK is embedded

iOS, Android, WeChat Mini Program

Types of personal information collected by the SDK

Device Information: Information such as device operating system information, device manufacturer information, device model, and device brand. After de-identification, such information is used to establish abnormal traffic detection models and support traffic anti-fraud technologies.

Device Network Information: Information such as the device's network connection status and network type. After de-identification, such information is used to establish abnormal activity and virtual device detection models and support traffic anti-fraud technologies.

Device Environment Information: Information such as device screen size, battery charging status, battery level, device jailbreak/root indicators, device debugging indicators, and mobile network operator name. After de-identification, such information is used to establish abnormal activity and virtual device detection models and support traffic anti-fraud technologies.

User Behavioral Trajectory Information: This category of information does not refer to business process navigation data generated when a user moves from one page to another. Rather, it refers to interaction trajectory data generated during the verification process, such as swipe patterns, click patterns, and mouse movement trajectories. After de-identification, such information is used to establish models for detecting simulated, brute-force, and forged interaction trajectories and to support traffic anti-fraud technologies.

Other Information: Information such as verification timestamps and application package names. Such information is used to establish baseline auxiliary models for abnormal activity detection and to support traffic anti-fraud technologies.

Link to the privacy policy of the SDK

https://www.geetest.com/Private

Qualifications & exceptions

• The stated purpose is anti-robot attack, and each category is said to be used after de-identification for detection models.
• The behavioural trajectory category is expressly distinguished from page-to-page navigation data.
• The SDK is embedded in the iOS, Android and WeChat Mini Program applications.

Data Access & Collection · Context

Third-party SDK: Geetest Captcha privacy policy link

The Geetest Captcha entry in the China appendix ends with a link to the SDK's own privacy policy, which is a document this source does not supply. The SDK details themselves are set out in the preceding part of the appendix.

Supporting quotations

Link to the privacy policy of the SDK

https://www.geetest.com/Private

Qualifications & exceptions

• The linked policy governs the SDK's own processing and is not reproduced here.

Data Access & Collection · Company practice

Third-party SDK: DeepZero DeepTrack

The China appendix lists the DeepZero DeepTrack SDK, provided by DeepZero, with the purpose of campaign performance tracking, embedded in the iOS, Android and WeChat Mini-Program applications. The personal information it collects is listed as location information, device information, version of the operating system, user identity identifier, behavioral information and channel promotion information. The appendix links to the SDK's own privacy policy.

Supporting quotations

DeepZero DeepTrack SDK

Provider of the SDK

DeepZero

Purposes of the SDK

Campaign Performance Tracking

Application where the SDK is embedded

iOS, Android, WeChat Mini-Program

Types of personal information collected by the SDK

Location Information, Device Information, Version of Operating System, User identity identifier, Behavioral information, Channel promotion information

Link to the privacy policy of the SDK

https://deeptrack.deepzero.com/docs/privacy

Qualifications & exceptions

• The stated purpose is campaign performance tracking.
• The SDK is embedded in the iOS, Android and WeChat Mini-Program applications.

Data Access & Collection · Company practice

China: mobile and location services, and the device setting that limits the collection

The China appendix says Hilton may collect personal information if a person downloads and uses its mobile applications or uses other digital platforms such as its WeChat Mini-Programs, and that it will obtain consent and process the information in accordance with the Statement. If the person allows access to location information on the device to provide application features and services, that information may include geolocation information; Hilton also collects device information such as phone brand, model, operating system and operating system version to direct the person to the appropriate app store. It says the collection can be prevented or limited by changing the settings in the Hilton Honors app or on the device.

Supporting quotations

4. Mobile and Location Services

We may collect your personal information if you download and use our mobile applications or use other digital platforms such as our WeChat Mini-Programs.

We will obtain your consent and collect, use, disclose and otherwise process this information in accordance with this Statement.

If you allow us to access the location information on your device to provide you with our application features and services, such information may include geolocation information.

We also collect device information, such as your phone brand, model, operating system, operating system version, to direct you to the appropriate APP store to download our mobile apps.

You can prevent or limit the collection of this information by changing the settings in the Hilton Honors APP or by changing the settings in your device.

Qualifications & exceptions

• Consent is obtained and the collection is stated to depend on the app being downloaded and used.
• The location collection depends on the person allowing device location access.
• The device information is collected to point the user to the right app store.
• The collection can be prevented or limited through app or device settings.

Data Access & Collection · Context

Nigeria: cookies and other technologies, as described in the main body

The Nigeria appendix says Hilton's site may use cookies or other technologies — pixel tags, web beacons, clear GIFs, links in emails, JavaScript, device IDs assigned by Google or Apple or similar — and refers the reader to the Online and Mobile Information We Collect section of the main body for more information. The appendix itself states no further detail about the use of these technologies.

Supporting quotations

6. Cookies and Other Technologies

Our site may use "Cookies" or "Other Technologies" (such as "pixel tags," "web beacons," "clear GIFs", links in emails, JavaScript, device IDs assigned by Google or Apple, or similar technologies).

Qualifications & exceptions

• The detail is in the main body rather than in the appendix.

Data Access & Collection · Company practice

Korea: cookies and other technologies used to provide personalized offers and content

The Korea appendix says Hilton's site may use cookies or other technologies — pixel tags, web beacons, clear GIFs, links in emails, JavaScript, device IDs assigned by Google or Apple or similar — to provide personalized offers and content, that cookies are small text files stored on the visitor's computer or mobile device when they visit a website, and refers the reader to the Online and Mobile Information We Collect section of the main body for more information.

Supporting quotations

3. Cookies and Other Technologies

Our site may use "Cookies" or "Other Technologies" (such as "pixel tags," "web beacons," "clear GIFs", links in emails, JavaScript, device IDs assigned by Google or Apple, or similar technologies) to provide personalized offers and content.

Cookies are small text files that are stored on your computer or mobile device when you visit a website.

Qualifications & exceptions

• The stated purpose here is providing personalized offers and content.
• The detail is in the main body rather than in the appendix.

Data Access & Collection · Context

Appendix B: Hilton Premium Club Japan programme information

The Appendix B says that if a person is a member of Hilton Premium Club Japan, including Hilton Dining Plus, the information that follows applies to the processing of their personal information in addition to the information disclosed in the rest of the Statement. It then introduces the categories of personal information collected in the past 12 months. The appendix is therefore an addition to the main disclosure, not a replacement.

Supporting quotations

Appendix B: Hilton Premium Club Japan Program

If you are a member of Hilton Premium Club Japan (HPCJ), including Hilton Dining Plus, the following information applies to the processing of your personal information in addition to the information disclosed in the remainder of this Statement.

We have collected the following categories of personal information in the past 12 months:

Qualifications & exceptions

• The appendix applies in addition to the rest of the Statement.
• The categories are those collected in the past 12 months.
• The programme covered is Hilton Premium Club Japan, including Hilton Dining Plus.

Data Access & Collection · Company practice

HPCJ: member number — source and first business purposes

In the Appendix B list, the HPCJ member number is obtained directly from members themselves and collected for the additional business or commercial purposes of fulfilling guest reservations, sending guests communications about their reservations, administering membership and activity in the Hilton Premium Club Japan loyalty programme, providing customer service and support, verifying identity, sending marketing communications by email, direct mail and social media, and performing analytics to provide guests with personalized offers and content. The further purposes are set out in the next part of the appendix.

Supporting quotations

HPCJ member number

We have obtained this personal information from the following sources:

Directly from members themselves

We collected this personal information for the following additional business or commercial purposes:

Fulfill guest reservations

Send guests communications relating to their reservations

Administer membership and activity in the Hilton Premium Club Japan Program loyalty program

Provide customer service and support

Verify identity

Send marketing communications via email, direct mail, and social media

Perform analytics in order to provide guests with personalized offers and content

Qualifications & exceptions

• The purposes are stated as additional to the purposes in the rest of the Statement.
• Only the first purposes of this category are stated in this part.

Data Access & Collection · Company practice

HPCJ: member number — remaining business purposes

The remaining stated purposes for the HPCJ member number are performing analytics to improve business operations, determining guests' eligibility for special or promotional rates, processing payments including strong customer authentication where required by law, processing transactions with partners, administering contests and sweepstakes, and detecting and preventing fraud.

Supporting quotations

Perform analytics to improve business operations

Determine guests' eligibility for special or promotional rates

Process payments including conducting strong customer authentication (SCA) when required by law

Process transactions with partners

Administer contests and sweepstakes

Detect and prevent fraud

Qualifications & exceptions

• Strong customer authentication applies only where required by law.

Data Access & Collection · Company practice

HPCJ: name — source, purposes and no additional sharing

In the Appendix B list, the name is obtained directly from consumers themselves and collected for the additional business or commercial purposes of administering membership and activity in the Hilton Premium Club Japan loyalty programme and conducting telephone calls to inquire about new memberships. The appendix states that the name is not shared with any additional third parties.

Supporting quotations

Name

We have obtained this personal information from the following sources:

Directly from consumers themselves

We collected this personal information for the following additional business or commercial purposes:

Administer membership and activity in the Hilton Premium Club Japan Program loyalty program

Conduct telephone calls to inquire about new memberships

We have shared this personal information with the following additional categories of third parties

We do not share name with any additional third parties.

Qualifications & exceptions

• The sharing statement is limited to additional third parties, that is, to the recipients beyond those described in the rest of the Statement.
• One stated purpose is soliciting new memberships by telephone.

Data Access & Collection · Company practice

HPCJ: telephone and fax numbers — source, purposes and sharing

In the Appendix B list, telephone and fax numbers are obtained directly from consumers themselves and collected for the additional business or commercial purposes of administering membership and activity in the Hilton Premium Club Japan loyalty programme, conducting telephone calls to inquire about new memberships, and processing payments including strong customer authentication where required by law. The information is shared with payment card issuers and payment processors as an additional category of third parties.

Supporting quotations

Telephone and fax numbers

We have obtained this personal information from the following sources:

Directly from consumers themselves

We collected this personal information for the following additional business or commercial purposes:

Administer membership and activity in the Hilton Premium Club Japan Program loyalty program

Conduct telephone calls to inquire about new memberships

Process payments, including conducting strong customer authentication (SCA) when required by law

We have shared this personal information with the following additional categories of third parties

Payment card issuers and payment processors

Qualifications & exceptions

• Strong customer authentication applies only where required by law.
• The sharing is stated as additional to the sharing described in the rest of the Statement.

Data Access & Collection · Company practice

HPCJ: email address — source and first additional purposes

In the Appendix B list, the email address is obtained directly from consumers themselves and collected for the additional business or commercial purposes of administering membership and activity in the Hilton Premium Club Japan loyalty programme. The remaining purposes for this category are set out in the next part of the appendix.

Supporting quotations

Email address

We have obtained this personal information from the following sources:

Directly from consumers themselves

We collected this personal information for the following additional business or commercial purposes:

Administer membership and activity in the Hilton Premium Club Japan Program loyalty program

Qualifications & exceptions

• Only the first purpose of this category is stated in this part.

Data Access & Collection · Company practice

HPCJ: email address — remaining purposes and sharing

The remaining stated purposes for the email address in the Appendix B list are authenticating the Hilton Premium Club Japan Programme account and processing payments including strong customer authentication where required by law, and the information is shared with payment card issuers and payment processors as an additional category of third parties.

Supporting quotations

Authenticate Hilton Premium Club Japan Program account

Process payments, including conducting strong customer authentication (SCA) when required by law

We have shared this personal information with the following additional categories of third parties

Payment card issuers and payment processors

Qualifications & exceptions

• Strong customer authentication applies only where required by law.
• The sharing is stated as additional to the sharing described in the rest of the Statement.

Data Access & Collection · Company practice

HPCJ: home address — source, purpose and no additional sharing

In the Appendix B list, the home address is obtained directly from consumers themselves and collected for the additional business or commercial purpose of administering membership and activity in the Hilton Premium Club Japan loyalty programme. The appendix states that the home address is not shared with any additional third parties.

Supporting quotations

Home address

We have obtained this personal information from the following sources:

Directly from consumers themselves

We collected this personal information for the following additional business or commercial purposes:

Administer membership and activity in the Hilton Premium Club Japan Program loyalty program

We have shared this personal information with the following additional categories of third parties

We do not share home address with any additional third parties.

Qualifications & exceptions

• The sharing statement is limited to additional third parties.

Data Access & Collection · Company practice

HPCJ: date of birth — source, purposes and sharing

In the Appendix B list, the date of birth is obtained directly from customers themselves and collected for the additional business or commercial purposes of administering membership and activity in the Hilton Premium Club Japan loyalty programme, providing customer service and support, verifying identity, sending marketing communications by email, direct mail and social media, performing analytics to provide guests with personalized offers and content, performing analytics to improve business operations, and processing payments including strong customer authentication where required by law. The information is shared with payment card issuers and payment processors and with Hilton's Third-Party Partner as additional categories of third parties.

Supporting quotations

Date of birth

We have obtained this personal information from the following sources:

Directly from customers themselves

We collected this personal information for the following additional business or commercial purposes:

Administer membership and activity in the Hilton Premium Club Japan Program loyalty program

Provide customer service and support

Verify identity

Send marketing communications via email, direct mail, and social media

Perform analytics in order to provide guests with personalized offers and content

Perform analytics to improve business operations

Process payments including conducting strong customer authentication (SCA) when required by law

We have shared this personal information with the following additional categories of third parties

Payment card issuers and payment processors

Hilton's Third-Party Partner

Qualifications & exceptions

• Strong customer authentication applies only where required by law.
• The sharing is stated as additional to the sharing described in the rest of the Statement.

Data Access & Collection · Company practice

HPCJ: gender — source, purposes and sharing

In the Appendix B list, gender is obtained directly from members themselves and collected for the additional business or commercial purposes of administering membership and activity in the Hilton Premium Club Japan loyalty programme, providing customer service and support, performing analytics to provide guests with personalized offers and content, and performing analytics to improve business operations. The information is shared with Hilton's Third-Party Partner as an additional category of third parties.

Supporting quotations

Gender

We have obtained this personal information from the following sources:

Directly from members themselves

We collected this personal information for the following additional business or commercial purposes:

Administer membership and activity in the Hilton Premium Club Japan Program loyalty program

Provide customer service and support

Perform analytics in order to provide guests with personalized offers and content

Perform analytics to improve business operations

We have shared this personal information with the following additional categories of third parties

Hilton's Third-Party Partner

Qualifications & exceptions

• The sharing is stated as additional to the sharing described in the rest of the Statement.

Data Access & Collection · Company practice

HPCJ: payment card information — source, purpose and no additional sharing

In the Appendix B list, payment card information is obtained directly from consumers themselves and collected for the additional business or commercial purpose of administering membership and activity in the Hilton Premium Club Japan loyalty programme. The appendix states that payment card information is not shared with any additional third parties.

Supporting quotations

Payment card information

We have obtained this personal information from the following sources:

Directly from consumers themselves

We collected this personal information for the following additional business or commercial purposes:

Administer membership and activity in the Hilton Premium Club Japan Program loyalty program

We have shared this personal information with the following additional categories of third parties

We do not share payment card information with any additional third parties.

Qualifications & exceptions

• The sharing statement is limited to additional third parties.

Data Access & Collection · Company practice

HPCJ: Hilton Honors number — source, purpose and no additional sharing

In the Appendix B list, the Hilton Honors number is obtained directly from Hilton Honors members themselves and collected for the additional business or commercial purpose of administering membership and activity in the Hilton Premium Club Japan loyalty programme. The appendix states that the Hilton Honors number is not shared with any additional third parties.

Supporting quotations

Hilton Honors number

We have obtained this personal information from the following sources:

Directly from Hilton Honors members themselves

We collected this personal information for the following additional business or commercial purposes:

Administer membership and activity in the Hilton Premium Club Japan Program loyalty program

We have shared this personal information with the following additional categories of third parties

We do not share Hilton Honors number with any additional third parties.

Qualifications & exceptions

• The sharing statement is limited to additional third parties.

Data Access & Collection · Company practice

HPCJ: device information — source, SCA purpose and sharing

In the Appendix B list, device information including MAC address is obtained directly from consumers as a result of their browsing activity on the internet or scanning QR codes on property, and collected for the additional business or commercial purpose of conducting strong customer authentication as part of the payment process when required by law. It is shared with payment card issuers and payment processors, but only when conducting strong customer authentication.

Supporting quotations

Device information (including MAC address)

We have obtained this personal information from the following sources:

Directly from consumers as a result of their browsing activity on the internet or scanning or QR codes on property

We collected this personal information for the following additional business or commercial purposes:

Conduct SCA as part of the payment process, when required by law

We have shared this personal information with the following additional categories of third parties

Payment card issuers and payment processors when conducting SCA

Qualifications & exceptions

• The source is browsing activity or scanning QR codes on property.
• Both the purpose and the sharing are limited to the strong customer authentication case.

Data Access & Collection · Company practice

HPCJ: company information — source, purposes and sharing

In the Appendix B list, company information including department and title is obtained directly from members themselves and collected for the additional business or commercial purposes of administering membership and activity in the Hilton Premium Club Japan loyalty programme, providing customer service and support, performing analytics to provide guests with personalized offers and content, and performing analytics to improve business operations. The information is shared with Hilton's Third-Party Partner as an additional category of third parties.

Supporting quotations

Company information (including department and title)

We have obtained this personal information from the following sources:

Directly from members themselves

We collected this personal information for the following additional business or commercial purposes:

Administer membership and activity in the Hilton Premium Club Japan Program loyalty program

Provide customer service and support

Perform analytics in order to provide guests with personalized offers and content

Perform analytics to improve business operations

We have shared this personal information with the following additional categories of third parties

Hilton's Third-Party Partner

Qualifications & exceptions

• The sharing is stated as additional to the sharing described in the rest of the Statement.