About this Privacy Notice

At e&, we are committed to protecting and respecting your privacy. We recognise and value the trust that you place in us when you provide us with your personal data and we aim to protect in line with applicable data protection laws.

This privacy notice explains how we use the personal data that we may collect from you if you visit our website or make a reservation to stay in our hotel.

In this notice, “hotel”, “we”, “us” and “our” refers to our eStay Hotel, owned by Etisalat Services Holding L.L.C (Dubai Branch) which is part of Emirates Telecommunications Group Company PJSC, collectively “e&”.

We encourage you to read and understand this privacy notice. It will help you understand:

• the personal data we may collect about you during the booking process and during your stay;
• how we may use that personal data;
• when we may share or disclose your personal data with third parties;
• when we may transfer your personal data outside of the jurisdiction where it was collected;
• how long we will retain your personal data;
• your rights concerning your personal data;
• what to do if you have a complaint relating to your personal data; and
• how to contact us.

This privacy notice applies to personal data that we collect and process as part of the services offered by our hotel. We collect this data when individuals:

• Visit our website or make an inquiry about the hotel;
• Register for our loyalty program;
• Book a stay at our hotel;
• Use the services offered at our premises, (e.g. spa or sports facilities); and
• Participate in events at our hotel.

The Personal Data We May Collect About You

Your “personal data” means any information, which allows us to identify you directly or indirectly. We may collect and process the following types of personal data, in accordance with applicable laws:

• Basic Personal Information: name, address, contact details, date of birth, nationality, gender, about you and other guests under the same booking
• Government-Issued Identification: Emirates ID, passports or other official proof of identification (and the personal data contained in those IDs)
• Financial Information: payment details, credit or debit card data
• Travel Information: booking details, special service and amenity requests
• Photographic and Video Information: CCTV images and footage

Special Categories of Personal Data

We may also process special categories of personal data, where lawful and relevant. This will be limited to the extent necessary for the provision of our services and products and may include: data concerning health, such as, any existing medical conditions, mobility needs or dietary requirements. We will ensure that such data is processed in line with applicable laws and only for specific purposes directly related to our services and products.

Sources of Personal Data

Data Collected Directly from You

We generally collect personal data directly from you as part of the booking process, during your stay or when you use any of our facilities. For examples, this may occur when you:

• Fill out any of our booking forms online or as part of the check in process
• Register to use any of our facilities or book an event with us
• Provide details on specific requests made in relation to our services and products

Data Collected from Other Sources

This may include information obtained from our partners, such as travel, hospitality and event agencies in the context of your bookings or stays with us (e.g. online and local travel agencies, transport providers, etc.) or our on-site providers (e.g., spa, health club, restaurant, etc.).

How We Use Your Personal Data

We will process your personal data when you make a reservation to stay at our hotel or to use any of our related services or facilities. This may include the following activities:

• Booking and guest registration – accommodation bookings, checking-in, checking-out and payments.
• Stay associated services – transportation arrangements, concierge, preferences or changes to your bookings, personalising services, making arrangements with third parties, such as, tours, amenity provisions, and complying with age restrictions for services.
• Meetings and events – planning and coordination, booking venues, handling logistics, catering arrangements, and coordinating with vendors.
• Hotel operations – customer care, inquiries, handling complaints, security.
• Restaurants and sports facilities – bookings and reservations, ensuring eligibility, delivering personalised service.
• Loyalty programs and relationship management – managing loyalty programmes, enrolling members, tailoring benefits, providing additional customer support to enhance loyalty and satisfaction
• Marketing and advertising – targeted marketing campaigns, personalised advertising, promotions.
• Legal and policy compliance – ensuring compliance with applicable laws and internal policies, including those related to hospitality, payment processing and general safety and security operations at our facilities.
• Other lawful purposes – carrying out any other lawful activities reasonably related to your stay with us or the use of our facilities.

Grounds for Processing Personal Data

By using our services or products, you consent to us processing your personal data in accordance with the terms of this policy. We may also process your personal data to comply with applicable legal and regulatory requirements, and to fulfil our contractual obligations (i.e. fulfil your requested services and products, such as, hotel bookings).

Sharing or Disclosing Your Personal Data

Within Our Group of Companies

We may share your personal data with other members of our group for the purposes described above. We will take steps to ensure that the personal data is accessed only by the hotel, authorised e& employees and authorised third parties that have a need to access the data for the purposes described in this notice.

With Third Parties Outside Our Group of Companies

We may need to share your personal data with third parties outside of our organisation for various reasons related to your stay at our hotel. Third parties that we may share your data with include the following:

• Travel Agencies & Partners: organisations that provide travel related services on our behalf.
• Service Providers: companies that provide products and services to us, including events agencies, logistics and transportation companies, catering providers.
• Professional Advisors: our accountants, lawyers, and other professional advisors who assist us in business, legal, or contractual matters.

In all cases, we will only share your personal data in accordance with applicable law and with organisations we have a written agreement with. We have strict internal controls to ensure that only the minimum necessary information is shared with third parties and that is properly protected.

We may also disclose your personal data with public or government authorities in compliance with our legal obligations, such as, for security and crime prevention purposes.

Cross-Border Transfers

To the extent permitted by applicable data protection law, the personal data that we collect from you may be transferred to, and stored at, a destination outside of the jurisdiction in which it was originally collected (“Relevant Location”). It may also be stored and processed by other companies and/or third parties in other countries.

Where your personal data is transferred outside of the Relevant Location, we aim to ensure that it is protected in a manner that is consistent with how your personal data will be protected by us in the Relevant Location. In all cases, we will ensure that any transfer of your personal data is compliant with applicable data protection law.

You can get more details about the protection given to your personal data when it is transferred outside the Relevant Location by contacting us (see ‘How to contact us’).

How Long We Will Retain Your Personal Data

We will keep your information for as long as it is necessary to fulfil the purposes described in this privacy notice and in accordance with applicable data protection laws. The actual period of time that we hold your personal data may change and is determined by different factors, including:

• For the duration of our ongoing relationship with you and provide you with the services you have requested (for example, for as long as you have an eStay Hotel loyalty account or keep using our services); and
• Whether there is a legal obligation to which we are subject that set minimum retention periods for your personal data (for example, we may need to keep information about your past bookings and payment transactions for a certain period of time before we can delete them in line with applicable consumer and financial regulations).

Your Rights Concerning Your Personal Data

You have a number of legal rights in relation to your personal data. Depending on where your personal data is located, these rights may include the following:

• Right to a copy of your personal data: you can access or receive a copy of the personal data which we hold about you.
• Right to rectification: you can request that we correct your personal data if it is inaccurate or incomplete.
• Right to erasure: you can request that we erase your personal data in certain circumstances.
• Right to restrict processing: you can request that we restrict the means or manner in which we are processing your personal data in certain circumstances, even though we may continue to store it.
• Right to portability: where technically possible, you can request that we move, copy or transfer your personal data back to you (or to another controller) to reuse it;
• Right against discrimination: you have the right to not be discriminated against by us when exercising your rights;
• Right to object: you can object to the processing of your personal data by us in certain circumstances;
• Right to withdraw consent: you are entitled to withdraw your consent to personal data processing at any time. Please note, however, that if you withdraw your consent we will not be able to progress with your booking. We may still be entitled to process your personal data if we have another legitimate reason for doing so (for example, we may need to retain personal data to comply with a legal obligation).
• Right to raise a complaint: you can lodge a complaint with the local data protection authority if you have any concerns about how your personal data is being processed.

You can exercise your rights in line with applicable data protection law in the relevant location by contacting us (see ‘How to Contact Us’ section below).

Direct Marketing

We may use the information you give us for direct marketing purposes. This means we will use the information to provide you with promotions, discounts and details of events or other communications that we think you will be interested in. We will only do this with your consent (where required by law).

You can opt-out of receiving directing marketing from us at any time. You can do this by:

• clicking on the “unsubscribe” link included at the end of any marketing communication that we send you, or
• contacting us (see ‘How to contact us’).

Keeping Your Personal Data Secure

We have appropriate security measures in place to prevent your personal data from being accidentally lost, or used or accessed in an unauthorised way. We limit access to your personal data to those who have a genuine business need to access it. Those who may be processing your personal data will do so only in an authorised manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

Cookies

We may (or may ask our partners to) set cookies on the device that you use to access our website. Most of the time we do not know who you are from this information, but we may be able to identify you from some of the data collected using these cookies. For example, we may be able to link the information that we collect about you with information provided to us by third parties. We will always use this information in accordance with this notice.

What to Do If You Have a Complaint Relating to Your Personal Data

You can contact us (see ‘How to contact us’) if you have any concerns about how we have handled your personal data. If you are not satisfied with the manner in which we have dealt with your complaint, you may contact the relevant data protection authority in your jurisdiction.

How to Contact Us

If you would like further information on the collection, use, disclosure, transfer or processing of your personal data or the exercise of any of the rights listed above, please contact the e& Group Data Protection Officer at groupdataprotection@eand.com.

Changes to this Privacy Notice

Please review this privacy notice at regular intervals as we may update it from time to time at our discretion. If we intend to use your previously collected personal data for a new purpose that is incompatible with the purposes described in this privacy notice or at the time of collection, we will provide you with additional notice and, where legally required, seek your consent.