Privacy Policy

This privacy policy was last updated on 13th May 2026

− A. Who We Are

− B. What Is The Purpose Of This Policy?

− C. Personal Information We Collect And Some Circumstances Of Collection

− D. The Purposes For Which We Collect, Use Or Disclose Your Personal Data

− E. Provision of Third Party Personal Data By You

− F. Your rights

− G. Cookies

− H. Third-party links

− I. How Do We Store Data?

− J. Change to the Policy

− K. Complaint Process

− L. General

− A1. South Korea Privacy Policy Addendum

− A2. Laos Privacy Policy Addendum

− A3. Singapore Privacy Policy Addendum

1. Who We Are

1. The following table lists the data controllers (collectively, “we” or “our” or “us”) and their relevant information for the personal data collected by H World Group in different countries/regions.

2. What Is The Purpose Of This Policy?

2. We value you as our guest and recognizes that privacy is important to you. The purpose of this Privacy Policy (“Privacy Policy” or “Policy”) is to inform you and provide you with an understanding of how we, our affiliates, related corporations and/or associated companies globally (collectively, the “H World Group” or “H World Group Companies”), handle, collect, use, disclose and deal with personal data about you that you give us, that we receive through third parties or that is in our possession. Please read this Privacy Policy carefully.

3. We are committed to safeguarding the privacy and security of your personal data. We take our responsibilities under Singapore’s Personal Data Protection Act (the “PDPA”) or other applicable data protection law seriously. We also recognize the importance of the personal data you have entrusted to us and believe that it is our responsibility to properly manage, protect and process your personal data. Please do not provide any personal data to us if you do not agree with our Privacy Policy.

3. Personal Information We Collect And Some Circumstances Of Collection

4. “Personal data” is defined under the PDPA or other applicable data protection laws to mean data, whether true or not, about an individual who can be identified from that data, or from that data and other information to which an organisation has or is likely to have access. We collect information about you, such as when you provide your information to us, when you check into our hotel, when you use our Websites, when you make a reservation with a restaurant at our hotel, when you interact with us, when you enter into a transaction with us, and/or when a booking agent provides us with your information. Further details below.

5. We collect personal data/information about you or related to you, such as:

• name
• home address
• Birth date
• identification number (such as national ID, passport details, etc.)
• image and/or photograph 
• credit card information: credit card number, expiry date 
• contact information
• transactional information
• usage and preferences (if and/or when we collect such information)
• bank account number
• your purchase and/or your transactions with us

We will collect your personal data in accordance with the PDPA or other applicable data protection laws.

6. Some instances of when we collect personal data include:

• through websites operated by us and/or through the software applications made available by us for use on or through computers and mobile devices (collectively, the “Websites”);
• through our social media pages that we control (collectively, our “Social Media Pages”);
• through email messages that we send you and through your communications with us online or in person;
• from third parties such as Online Travel Agency (“OTA”), Global Distribution System (“GDS”), corporate clients’ Travel Management Company (“TMC”) or Travel Management System (“TMS”) and other sources, such as public databases, marketing partners and other third parties; and
• when you visit or stay as a guest at one of our properties or through other offline interactions (collectively, “Property Visits and Offline Interactions”).

Collectively, we refer to the Websites and our Social Media Pages, as the “Online Services” and, together with the Property Visits and Offline Interactions, the “Services.” By using any of our Services and/or by agreeing to this Policy, e.g. in the context of registering for any of our products or services, you understand and acknowledge that we will collect, use and/or disclose your personal data as described in this Policy.

7. We may collect your information from third parties set out below:

• technical data from analytics providers such as Google;
• contact, financial and transaction data from providers of technical, payment and delivery services, our affiliates, business partners and other independent third parties; and
•  Owners and Franchisees: we may collect personal data from Owners of H World Group branded properties that we manage. We may also collect personal data from Franchisees of H World Group branded properties that are independently owned and operated under a franchise agreement with us. Owners and Franchisees are independent from H World Group.

8. For example, when you click a link from a website operated by one of our business partners to visit our Websites, and you have registered with our partner, the partner may share with us the information you have provided to them as permitted by applicable law.

9. Another example is when you use our service through the websites or mobile applications operated by our affiliates or business partners (for example, an online travel agency platform). The information related to the services you provide to them may be transferred to us so that we can process your orders and ensure your booking.

4. The Purposes For Which We Collect, Use Or Disclose Your Personal Data

10. We, our affiliates, related corporations and associated companies globally, will/may collect, use, disclose and/or process your personal data for one or more of the following purposes:

1.     processing and/or dealing with your interest in our products and/or services;
2.     considering, processing, dealing with and/or managing, your booking, reservation, request/application for, of or your purchase of rooms, hotel stay, dining, our products and/or services (the “Transaction”);
3.     facilitating, processing, dealing with, administering and/or managing Transaction(s) by or with you;
4.     dealing with and/or providing the Services to you;
5.     administering, facilitating, managing, processing and/or dealing with your relationship with us, your stay with us as a hotel guest, your being our dining guest, your being our loyalty card member or rewards member or other programme member (such as the H Rewards, whose privacy policy can be found at https://hrewards.com/en/legal/data-protection) your use of our facilities, any transactions or activities carried out by you on the Websites or at our premises/establishments or with us, your requests, including but not limited to dealing with your laundry requirements/requests, dealing with your room service requests, dealing with housekeeping matters, dealing with your ad hoc queries, requests or bookings such as with concierge or for transport or porter service etc, dealing with your preferences, dealing with your membership needs, dealing with your transportation needs, dealing with your tour bookings, dealing with your tourist sites visits, dealing with your entertainment bookings (including shows, movies, events etc.), processing your room or dining reservations, processing orders and payment transactions, implementing transactions and the supply of products and/or services to you that you have requested. Without limiting the generality of the foregoing, should you make a reservation or transaction that includes third party individual(s) or on behalf of third party individual(s) or for third party individual(s), you consent to us disclosing personal data that identifies you, to the said third party individual(s) (such as but not limited to your name);
6.       administering, facilitating, processing and/or dealing in any matters relating to your use or access of the Websites, including identifying you for login to the Websites, our portals and other online services provided by or on behalf of us. Without limiting the generality of the foregoing, if you:

1.          gain access to or sign in to the Websites, using your login credentials of a Social Networking Site, or
2.         use any features of a Social Networking Site such as its widgets, plug-ins and browser push notifications, made available to you on our Websites,  it may result in information or your personal data being collected or shared between us and the third party. For example, if you use Facebook’s “Like” feature, Facebook may register the fact that you “liked” a product and may post that information on Facebook. (“Social Networking Site” refers to an online or digital platform owned or operated by a third party, that is used by people to build social networks or social relations, or to interact, with other people, such as but not limited to Facebook, Instagram, Twitter). By your proceeding pursuant to (i) or (ii) above, you consent to such collection, use or disclosure of your personal data;

7.     monitoring, processing and/or tracking your use of the Websites in order to provide you with a seamless experience, facilitating or administering your use of the Websites, and/or to assist us in improving your experience in using the Websites;
8.     administering, facilitating, processing and/or dealing in any transactions, payments, or activities carried out by you on the Websites or at our premises/hotels/establishments or with us;
9.       providing services to you as our hotel guest, as our customer, as a member of our loyalty programme(s)/card programme(s)/rewards programme(s) or when requested by you; dealing with or administering your participation in contests, gamification, social events organized by us;
10.       registering you as our customer and/or to deal with, process and/or administer the account that you may open with us, whether a membership account or otherwise, including to facilitate your transactions or activities on our premises, the Websites, or your transactions or activities with us;
11.     carrying out your instructions or responding to any enquiry given by (or purported to be given by) you or on your behalf including responding to your enquiries and complaints; or responding to or dealing with your interactions with us or your requests; or responding to or dealing with your feedback, comments or reviews;
12.       contacting you or communicating with you via phone/voice call, text message and/or fax message, email and/or postal mail for one or more of the Purposes stated herein. You acknowledge and agree that such communication by us could be by way of the mailing of correspondence, documents or notices to you, which could involve disclosure of certain personal data about you to bring about delivery of the same as well as on the external cover of envelopes/mail packages; 
13.   sharing or disclosing (at our discretion) your suggestions, comments, feedback or content (including audio, video etc.) (collectively “Feedback”) that you provide through Social Networking Sites, to the Online Services or to us (including at our premises), with other users of the Online Services or with the public, for publicity and/or promotion purposes with a view to marketing or showcasing our business, products or services (and/or that of any member of the H World Group Companies), and/or to acquiring customers, and/or for the purpose of providing the public with your Feedback which may be useful for the public’s patronage decision or for the public’s information or otherwise. This includes us disclosing your name together with your Feedback. Without limiting the generality of the foregoing, in the above regard, your Feedback and name may/will be published or shared by us on public media platforms such as the newspaper, the Internet, in our (including our affiliates’) annual reports (if any) etc., and/or incorporated as part of our (and/or of the H World Group Companies’) marketing collaterals/materials or corporate video to be disclosed to the public, and you hereby consent to the same. Do not provide us with Feedback if you do not wish for such Feedback to be disclosed to the public. If you wish to give us your Feedback without it being disclosed to the public, please separately email us at dataprivacyAPAC@hworld.com and head the subject of your email with the word “Confidential”;
14.     understanding and/or managing your interests, concerns and preferences;
15.     to comply with or enforce the terms and conditions of any contract or agreement entered into by or on behalf of us (and/or of any member of the H World Group Companies) to which we (and/or of any member of the H World Group Companies) is otherwise bound or is obliged to observe, and/or to deal with the administration or management of such contract. Without limiting the generality of the foregoing, an example would be where you had made a room booking at our hotel not directly with us but with a third party hotel reservation operator and in this regard we would need to and you hereby consent to us collecting, using or disclosing your personal data from or to such third party hotel reservation operator;
16.     carrying out due diligence, statutorily required activities or other screening activities (including background checks, anti-money laundering checks, know your client checks) in accordance with legal or regulatory obligations applicable to us (whether Singapore or other countries), the requirements or guidelines of governmental authorities which we determine are applicable to us (whether Singapore or other countries), and/or our risk management procedures that may be required by law (whether Singapore or other countries) or that may have been put in place by us or our affiliates/associated companies;
17.     to prevent or investigate any fraud, unlawful activity or omission or misconduct, whether or not there is any suspicion of the aforementioned; dealing with conflict of interests; or dealing with and/or investigating complaints;
18.      complying with or as required by any applicable law, governmental or regulatory requirements of any jurisdiction applicable to us or our affiliates/associated companies, including meeting the requirements to make disclosure under the requirements of any law binding on us or our affiliates/associated companies, and/or for the purposes of any guidelines issued by regulatory or other authorities (whether of Singapore or other countries), with which we or our affiliates/associated companies are expected to comply;
19.     complying with or as required by any request or direction of any governmental authority (whether Singapore or other countries) which we or any of our H World Group Companies are/is expected to comply with; or responding to requests for information from public agencies, ministries, statutory boards or other similar authorities (whether Singapore or other countries). For the avoidance of doubt, this means that we may/will disclose your personal data to the aforementioned parties upon their request or direction;
20.        conducting research, (including customer research), surveys, market surveys, analysis and development activities (including but not limited to data analytics, and/or profiling), obtaining your feedback to our products, services or facilities, to:

1.       improve or develop our products, services and/or facilities in order to enhance any continued interaction between yourself and us connected or in relation to your relationship with us, the Websites, or your Transaction(s);  
2.      improve any of our products or services or facilities, whether now or in the future; or
3.     improve our understanding of your interests, concerns and preferences.

Without limiting the generality of the foregoing, we may/will in this regard send you surveys or request a face to face interview survey or request your feedback, by way of email or postal mail;

21.      the conduct of training or training purpose, so as to develop or improve our products or services and/or our staff’s and agents’ services and/or service quality. Without limiting the generality of the foregoing, such training may involve collection, use, disclosure or processing of your personal data including your feedback or comments or reviews;
22.     to facilitate and/or ensure the safety and security of our premises, our guests, our staff and/or visitors to our premises; to deal with, handle and/or conduct disciplinary, security, crime prevention and/or quality assurance processes, matters and/or arrangements. Without prejudice to the generality of the aforesaid, we wish to bring to your attention that there are surveillance cameras installed throughout our premises including at dining establishments and/or our offices, for security, crime prevention, safety and training reasons and you acknowledge that your personal data will be collected by such cameras and processed by us consequently;
23.    for marketing purpose where you have provided your consent to us for the same, and with such consent, we may/would be providing you with marketing, advertising and promotional information, materials and/or documents relating to products, services and/or events (including products, services and/or events of third party organisations with which we may collaborate with) that we (including a H World Group Company) or such third party organisations may be selling, marketing, offering, organizing, involved in or promoting, whether such products, services and/or events exist now or are created in the future;
24.     storing, hosting, backing up (whether for disaster recovery or otherwise) of your personal data, whether within or outside Singapore;
25.     maintaining and/or developing our IT or business systems and infrastructure including testing and upgrading of these systems;
26.     creating reports with respect to your Transaction(s), transactions that we have with our customers and/or the Services that we have provided to customers;

1.       facilitating, dealing with and/or administering external audit(s) or internal audit(s) of our business and/or the business of our affiliates/related corporations, Transaction(s), our transactions with our customers and/or the Services that we have provided to customers;
2.      anonymization of your personal data. In this regard, you acknowledge that personal data that has been anonymized is no longer personal data and the requirements of the PDPA would no longer apply to such anonymized data;
3.    dealing with and/or facilitating a business asset transaction or a potential business assert transaction, where such transaction involves us as a participant or involves only our related corporation or affiliated company as a participant or involves us and/or any one or more of our related corporations or affiliated companies as participant(s), and there may be other third party organisations who are participants in such transaction. “Business asset transaction” is defined in the PDPA and includes the purchase, sale, lease, merger or amalgamation or any other acquisition, disposal or financing of an organisation or a portion of an organisation or of any of the business or assets of an organisation;
4.    record-keeping purposes and producing statistics and research for internal and/or statutory reporting and/or record-keeping requirements, of us or of our affiliates/related corporations;
5.     our or the H World Group Companies’ reporting purposes including but not limited to reporting on our business performance; and
6.    to deal with the or as part of a bankruptcy, winding up, reorganization, restructuring, insolvency, receivership or an assignment for the benefit of creditors, of us,

(the purposes set out in this paragraph 10 above shall be collectively referred to as the “Purposes”).

11. Failure to provide personal data where requested: as part of our contractual relationship, you are required to provide such personal data which are required to establish and perform the accommodation agreement or other relevant agreement, which we are legally required to collect or which we need to perform the contract in question. Without such data, we will generally not be able to conclude the agreement with you or to execute the same. In the event you should not provide us with the necessary information, we might not be able to provide you with the requested Services or might not be able to do so completely.

12. For the avoidance of doubt, you consent to our using, disclosing and/or processing personal data that we currently possess about you and/or that we had lawfully received from third parties or other H World Group Companies, for the Purposes.

13. We may/will need to disclose your personal data to third parties, whether located within or outside Singapore or the jurisdiction you are located, for one or more of the above Purposes, as such third parties, would be processing your personal data for one or more of the above Purposes. In this regard, you hereby acknowledge, agree and consent that we may/are permitted to disclose your personal data to such third parties (whether located within or outside Singapore or the jurisdiction you are located) for one or more of the above Purposes and for the said third parties to subsequently collect, use, disclose and/or process your personal data for one or more of the above Purposes. Without limiting the generality of the foregoing or of paragraph 10, such third parties include:

1.     our associated or affiliated organisations or related corporations;
2.     any of our agents, contractors or third party service providers that process or will be processing your personal data on our behalf including but not limited to those which provide administrative or other services to us such as mailing houses, telecommunication companies, information technology companies, data centres, hosting and maintenance service providers, analysis services service providers, e-mail messaging services service providers, delivery service provider, handling of payment transactions service providers, marketing service providers;
3.     our professional advisers, for example, our auditors and lawyers, as well as our insurers;
4.     third parties to whom disclosure by us is for one or more of the Purposes and such third parties would in turn be collecting and processing your personal data for one or more of the Purposes. Without limiting the generality of the foregoing, such third parties to which we may/will disclose your personal data include third party hotel reservation operators, airline companies, transportation or limousine providers, travel agencies; tour booking operators, entertainment operations or venues such as shows, events, movies, or tourist sites operators; payment, finance companies or banks including credit card companies and security service providers;
5.     Government authorities/law enforcement officials: personal data may be also shared with government authorities and/or law enforcement officials if required for the one or more of the Purposes above, if mandated by applicable laws or if required for the legal protection of our legitimate interests in compliance with applicable laws; and
6.       any actual or proposed assignee or transferee of our business, or a merged entity in the event we merged to create the said merged entity.

14. We may share your information with other H World Group Companies from time to time for one or more of the Purposes.

15. Should you provide us with personal data of your child or children, you confirm, declare and agree that you are the parent and/or legal guardian of such child/children, and that we may collect, use and/or disclose your child’s or children’s personal data for the Purposes set out at paragraph 10 above and in the manner as set out at paragraphs 10, 13 and 14 above.

16. We may collect, use, disclose or process your personal data for other purposes that do not appear above. However, we will notify you of such other purpose at the time of obtaining your consent, unless processing of your personal data without your consent is permitted by the PDPA or by any other applicable data protection law.

17. To the extent permitted by law, we may/will also be collecting from sources other than yourself, personal data about you, for one or more of the above Purposes, and thereafter using, disclosing and/or processing such personal data for one or more of the above Purposes. We may combine information we receive from other sources with information you give to us and information we collect about you. We may use this information and the combined information for the Purposes set out above (depending on the types of information we receive).

18. We take reasonable steps to ensure that any personal data we collect, disclose and use is accurate and complete, if your personal data is likely to be used by us to make a decision that affects you, or disclosed to another organisation. However, it is important that you advise us of any changes to your personal data or if there are any errors in the personal data we hold about you. We will not be responsible for relying on inaccurate or incomplete personal data arising from your not updating us of any changes in your personal data that you had initially provided us with.

5.  Provision of Third Party Personal Data By You

19. Should you provide us with personal data of any individual other than yourself, you represent, undertake and warrant to us that:

1.      for any personal data of individuals that you disclose to us, you would have prior to disclosing such personal data to us obtained consent from the individuals whose personal data are being disclosed, to:

1.                    permit you to disclose the individuals’ personal data to us and the H World Group Companies for the Purposes; and
2.                  permit us and the H World Group Companies to collect, use, disclose and/or process the individuals’ personal data for the Purposes;

2.     at our request, you will use such form(s) or document(s) provided by us in obtaining such consents from the individuals in question (for the avoidance of doubt, we are under no obligation to you to create any such form(s) or document(s));  

3.     any personal data of individuals that you disclose to us are accurate; and

4.     for any personal data of individuals that you disclose to us, that you are validly acting on behalf of such individuals and that you have the authority of such individuals to provide their personal data to us and the H World Group Companies and for us and the H World Group Companies to collect, use, disclose and process such personal data for the Purposes.

6. Your Rights

20. You have certain rights regarding your personal data. These include:

1.     You have the right to access and/or correct any personal data that we hold about you, subject to exceptions under the law. This right can be exercised at any time by emailing us at dataprivacyAPAC@hworld.com. We will need enough information from you in order to ascertain your identity as well as the nature of your request, so as to be able to deal with your request. With respect to your access request, we may charge a fee in order to process it.
2.     For a request to access personal data, once we have sufficient information from you to deal with the request, we will seek to provide you with the relevant personal data within 30 days. Where we are unable to respond to you within the said 30 days, we will notify you of the soonest possible time within which we can provide you with the information requested. Note that the PDPA exempts certain types of personal data from being subject to your access request.
3.     For a request to correct personal data, once we have sufficient information from you to deal with the request, we will correct your personal data within 30 days. Where we are unable to do so within the said 30 days, we will notify you of the soonest practicable time within which we can make the correction. Note that the PDPA exempts certain types of personal data from being subject to your correction request as well as provides for situation(s) when correction need not be made by us despite your request.  
4.     We hold and deal with your personal data in accordance with the PDPA.
5.     Withdraw consent: 

1.                   You may withdraw your consent for the collection, use and/or disclosure of your personal data in our possession or under our control by emailing us at dataprivacyAPAC@hworld.com . We will process your request within a reasonable time from such a request for withdrawal of consent being made, and will thereafter not collect, use and/or disclose your personal data in the manner stated in your request, unless an exception under the law or a provision in the law permits us to. However, your withdrawal of consent could result in certain legal consequences arising from such withdrawal, including us being unable to perform the transactions requested by you or the termination of your relationship with us (depending on the extent of your withdrawal), as the case may be.
2.                 You may withdraw your consent for us to process your personal data for marketing purpose, that you had previously provided us with, at any time via one of the following relevant methods that we may make available:

1.     clicking the Unsubscribe button located at the bottom of our emailers;
2.     contacting us or our Data Protection Officer (“DPO”) through email (please refer to the contact details below); or
3.     updating your mailing preferences by logging in to your H Rewards account here (for H Rewards members only).

21. The PDPA may be amended from time to time to provide other rights, which we will accord to you. You may choose to seek information from us or to seek external legal advice, on what other rights you may have under the PDPA.

7. Cookies

22. We do not use cookies on our website.

8. Third-party links

23. The Websites and Services may contain links to third-party websites and applications. Any access to and use of such linked websites and applications is not governed by this Policy but instead is governed by the privacy policies of those third parties. We are not responsible for the information practices of such third-party websites or applications.

9. How Do We Store Data?

24. We are committed to keeping your personal data safe and strive to maintain the highest standards of security. We will put in place reasonable security arrangements to ensure that your personal data is adequately protected and secured. Appropriate security arrangements will be taken to prevent any unauthorised access, collection, use, disclosure, copying, modification, leakage, loss, damage and/or alteration of your personal data. However, we cannot assume responsibility for any unauthorised use of your personal data by third parties which are wholly attributable to factors beyond our control.

25.  We have put in place robust technical and organizational measures utilizing current state of the art technologies to ensure that your personal data is adequately protected against loss, misuse, unauthorised access, disclosure, alteration, and destruction. For the transfer of particularly sensible personal data via the internet, such as for example credit card details, we exclusively use encrypted transmission routes and we comply with the Payment Card Industry Data Security Standards (PCI DSS) which is a set of policies and procedures intended to optimize the security of credit, debit and cash card transactions and protect cardholders against misuse of their personal information.

26. Unfortunately, no transmission of data via the internet is completely secure. So, while we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our Websites. Any transmission is at your risk. Once we have received your personal data, we will use strict procedures and security features to prevent unauthorised access. This includes but is not limited to the following measures:

• Our internal processing takes place inside a VPN which is firewalled against the open internet and inside of which any kind of communication is processed in an encrypted way.
• We or our affiliate(s) employ a team of dedicated information security professionals and have established an information security system. In addition, H World Group has obtained ISO27001 and PCI-DSS certification.
• We have further taken security protection measures for data collection, storage, display, processing, use, deletion, destruction and other aspects and use access control as wells as AES256bit encryption.
• For the employees who may have access to your information, we sign confidentiality agreements with them and have established approval mechanisms for information access, internal or external transmission, and decryption. We also conduct regular training related to personal data protection to strengthen our employees’ awareness of privacy protection.
• As far as third parties (i.e. external companies) are rendering data processing services for us, we have committed them to contractually comply with appropriate data protection related obligations.

27. We will put in place measures such that your personal data in our possession or under our control is destroyed and/or anonymized as soon as it is reasonable to assume that (i) the purpose for which that personal data was collected is no longer being served by the retention of such personal data; and (ii) retention is no longer necessary for any other legal or business purposes. We will delete personal information in electronic files permanently so that it cannot be restored, and will shred or incinerate paper documents containing personal information.

10. Change to the Policy

28. We may modify this Policy from time to time. In the event we do so, we will update the date at the top of its first page accordingly. Please check back frequently as any updates we have made will be available on this page.

11. Complaint Process

29. If you have any complaint or grievance regarding about how we are handling your personal data or about how we are complying with the PDPA, we welcome you to contact us with your complaint or grievance.

30. Please contact us with your complaint or grievance by emailing us at dataprivacyAPAC@hworld.com.

31.  Where you are sending an email in which you are submitting a complaint, your indication at the subject header that it is a PDPA complaint would assist us in attending to your complaint speedily by passing it on to the relevant staff in our organisation to handle. For example, you could insert the subject header as “PDPA Complaint”.

32. We will certainly strive to deal with any complaint or grievance that you may have speedily and fairly.

12. General

33. Your consent that is given pursuant to this Privacy Policy is additional to and does not supersede any other consents that you had provided to us (and/or any member of the H World Group Companies) with regard to processing of your personal data.

34. For the avoidance of doubt, in the event that the PDPA or other data protection law permits an organisation such as us to collect, use or disclose your personal data without your consent, such permission granted by the law shall continue to apply.

35. How to contact us: if you have any questions about this Policy or the privacy aspects of our Services, please contact our DPO at dataprivacyAPAC@hworld.com.

A1. South Korea Privacy Policy Addendum

This South Korea Privacy Policy Addendum (“South Korea Addendum”) applies in limited cases where you are located in South Korea or if your personal information is otherwise subject to data protection laws in South Korea. The South Korea Addendum is regarded as a part of the Privacy Policy. In the event of an inconsistency between the South Korea Addendum and other parts of the Privacy Policy, the South Korea Addendum shall govern and prevail.

1. Period for Processing and Retaining

H World Hotel Management Pte. Ltd.(“H World Management”) process and retain personal information within the period agreed by the data subject at the time of collection or within the period of retention of personal information specified by the applicable laws and regulations as set forth below:

The Retention of Personal Information in Accordance with Applicable Laws

• Act on the Consumer Protection in Electronic Commerce, etc.

- Records of marks and advertisement: 6 Months

- Records of contract or withdrawal of subscription: 5 years

- Records of payment and supplying goods: 5 years

- Records of consumer’s complaint and the settlement of dispute: 3 years

• Electronic Financial Transactions Act

- Records of electronic financial transactions: 5 years

• Protection of Communications Secrets Act

- Records of computer communications or Internet log: 3 Months

• Labor Standards Act

- Register of employees and other important documents related to labour contracts: 3 years

2. International Transfer of Personal Information

We may need to transfer your personal information to our business partners or other recipients identified in the "Provision of Personal Information to Third Parties", "Outsourcing of Personal Information Processing" and “Storage of Personal Information” section in this Privacy Policy Addendum that are located outside of South Korea, including in countries that do not provide the same level of protection for personal information as does South Korea. In any case, we will only transfer personal information to recipients that provide an adequate level of data protection or as permitted by applicable data protection laws by implementing appropriate safeguards, including, but not limited to, relevant data transfer agreements when needed.

You have the right to refuse consent to such transfer and if you wish to refuse consent to such transfer, please contact us at dataprivacyAPAC@hworld.com; in such case however, we may not be able to provide you with our services.

3. Provision of Personal Information to Third Parties

You have the right to refuse consent to such transfer and if you wish to refuse consent to such transfer, please contact us at dataprivacyAPAC@hworld.com; in such case however, we may not be able to provide you with our services.

As set out in the Privacy Policy, we may share your personal Information with third parties in order to provide our services to you. These third parties may be located outside of South Korea.

Please note that we will not share your personal information with third parties without your consent, unless otherwise permitted by law.

The third parties who receive personal information include those set out in the table below.

4. Outsourcing of Personal Information Processing

If needed for service provision, some personal information processing (except storage) tasks may be outsourced to an external entity (outsourcee). These outsourcees may be located outside of South Korea.

We manage and supervise whether the outsourcees comply with laws and regulations on personal information protection by limiting the outsourcee's processing of personal information only to the extent necessary to execute the outsourced tasks, applying technical and administrative protective measures, and restricting re-entrustment.

If you wish to opt-out of the transfer of your personal information to outsourcee, please contact us at dataprivacyAPAC@hworld.com; in such case however, we may not be able to provide you with our services.

We outsource personal information processing to the outsourcees listed below.

5. Storage of Personal Information Outside of South Korea

If needed for service provision, some or total personal information may be stored outside of South Korea.

If you wish to opt-out of your personal information being stored outside of South Korea, please contact us at dataprivacyAPAC@hworld.com; in such case however, we may not be able to provide you with our services.

Personal information collected by us in South Korea is stored by the entities outside of South Korea listed below.

6. Criteria for Making Additional Use and Provision of Personal Information to Third Parties

We may additionally use and provide personal information without the consent of the information subject in accordance with the Article 15 (3) and 17 (4) of the Personal Information Protection Act.

Accordingly, we have considered the following points in order to make additional use and provision without the consent of the information subject.

• Whether the purpose of further use and provision of personal information is related to the original purpose of collection
• Whether the additional use or provision is foreseeable in light of the circumstances under which the personal information was collected or the processing practices
• Whether the additional use or provision of the personal information unreasonably prejudices the interests of the data subject
• Whether necessary measures have been taken to ensure safety, such as pseudonymization or encryption

7. Data Protection Officer

We have designated the Date Protection Officer for responding to user inquiries regarding personal information and resolving related complaints.

A2. Laos Privacy Policy Addendum

This Laos Privacy Policy Addendum (“Laos Addendum”) applies in limited cases where you are located in Laos or if your personal information is otherwise subject to data protection laws in Laos. The Laos Addendum is regarded as a part of the Privacy Policy. In the event of an inconsistency between the Laos Addendum and other parts of the Privacy Policy, the Laos Addendum shall govern and prevail.

1. Your Rights

You may exercise the following rights of your personal data:

• the right to amend the information provided;
• the right to stop the sending or transfer of information to third parties;
• the right to delete the information collected, or at the time that the purpose of the collection of the information expires.

        You may exercise your right by contacting us at quanjiquanji48@gmail.com.

2. Internation Data Transfer

We may need to transfer your personal information to our affiliates, business partners or other recipients that are located outside of Laos. In any case, we will only transfer personal information to recipients after obtaining your consent.

A3. Singapore Privacy Policy Addendum

This Singapore Privacy Policy Addendum (“Singapore Addendum”) applies where you are located in Singapore or where your personal data is otherwise subject to the Personal Data Protection Act 2012 of the Republic of Singapore. This Singapore Addendum is to be read as part of the Privacy Policy. In the event of an inconsistency between the Singapore Addendum and other parts of the Privacy Policy, the Singapore Addendum shall govern and prevail.

1.     Supplemental Application

This Singapore Addendum supplements the Privacy Policy and shall apply to the collection, use and disclosure of personal data in Singapore. This Singapore Addendum does not supersede or replace any other consents you may have previously provided to us in respect of your personal data, and your consents under the Privacy Policy and this Singapore Addendum are additional to any rights which we may have at law to collect, use or disclose your personal data.

2.     Marketing Communications and Do Not Call Registry

To the extent that any of the communication means which you have provided to us (including your Singapore telephone number) is or becomes listed on the Do Not Call Registry, we will comply with the applicable provisions of the PDPA in relation to the sending of specified marketing messages. Where required under the PDPA, we will only send marketing messages to your Singapore telephone number where:

• You have provided clear and unambiguous consent; or
• Applicable exemption under the PDPA applies.

For the avoidance of doubt, where you have provided your consent, you agree that we may contact you using such communication means (including via voice calls, SMS or other messaging applications) for the purposes set out in the Privacy Policy.

3.     User Security Practices

We recommend that you take reasonable steps to safeguard your personal data when accessing our Websites, portals or other services. In particular, where you access your account using a shared or public device, you should avoid enabling browser-based password storage functions, as this may permit unauthorised persons to access your personal data.

4.     Transfer of Personal Data Overseas

Your personal data may be transferred to, stored or processed outside of Singapore by us, our affiliates or third-party service providers. In such circumstances, we will comply with the PDPA, including taking appropriate steps to ensure that the recipient of such personal data is bound by legally enforceable obligations to provide a standard of protection comparable to that under the PDPA. We may disclose your personal data to our related corporations within the H World Group and to third-party service providers (including those processing personal data on our behalf), whether within or outside Singapore, for the purposes set out in the Privacy Policy, and will ensure that such disclosure is carried out in accordance with the PDPA, including the implementation of appropriate safeguards where required.

5.      Retention of Personal Data

Without limiting the generality of the Privacy Policy, we will retain personal data in our possession or under our control only for as long as it is necessary to fulfil the purposes for which it was collected, or as required or permitted by applicable laws. We will cease to retain personal data, or remove the means by which the personal data can be associated with particular individuals, as soon as it is reasonable to assume that such retention no longer serves the purposes for which the personal data was collected, and is no longer necessary for legal or business purposes.

6.      Data Breach Notification

In the event of a data breach involving personal data in our possession or under our control, we will assess the breach in accordance with the PDPA to determine whether the breach is notifiable. Where the data breach is assessed to be notifiable under the PDPA, we will:

• Notify the Personal Data Protection Commission of Singapore as soon as practicable, and in any event no later than the time prescribed under the PDPA; and
• Notify affected individuals as soon as practicable, where the data breach is likely to result in significant harm to the affected individuals or where otherwise required under the PDPA.

Where permitted under the PDPA, we may delay or refrain from notifying affected individuals if:

• such notification is not required under the PDPA; or
• an exception applies, including where a law enforcement agency has directed that notification be delayed or not be made.

We will take reasonable steps to contain, investigate and remediate any data breach, and to prevent the recurrence of such incidents, in accordance with our internal policies and applicable laws.

7.     Exercise of Rights and Procedural Requirements

In addition to the rights set out in the Privacy Policy:

• We may require you to provide sufficient information to verify your identity before processing any request relating to your personal data; and
• We may process such requests in accordance with our internal procedures and the PDPA.