artotel_less_arty_issues_v2_180910

21
All entities that accept, store, process or transmit credit card
data must comply with the PCI DSS. Where PCI or PCI DSS is
mentioned, it is referring to Payment Card Industry Data
Security Standard version 2.0
The hotel privacy policies
PPHE Hotel Group and its affiliates and subsidiaries, including
art’otel, have adopted privacy policies to protect the guest data
we collect from and about guests: through our websites, the
reservation system, our loyalty programmes, and the hotels we
own or operate. Our privacy policies reflect the importance we
place on earning and keeping the trust of guests who share
their personal information with us.
art’otel privacy policies describe what guest data art’otel and
its affiliates and subsidiaries collect, how art’otel uses it, with
whom art’otel shares it, and for what purposes. The art’otel
privacy policies state that when art’otel shares guest data with
its Licensees, the Licensees are legally bound to use that guest
data only for the purposes for which art’otel provides it to the
Licensee, and to take its best efforts to protect the data against
unauthorised access or misuse. Should art’otel share data with
a Licensee not located in the EU, an assessment of the legal
requirements in order to share data must be performed.
To review art’otel privacy policies, visit;
http://www.pphe.com/site-services/privacy-policy
Ownership & processing of guest data
As between Licensee and art’otel, art’otel owns all art’otel guest
data. Licensee may process art’otel guest data subject to the
following terms and conditions:
Limited purposes
Licensee may process art’otel guest data only in connection
with the operation of an art’otel, and only for the purposes for
which it was originally collected or to which the guest has
since consented.
Compliance with laws
Licensee may process art’otel guest data only as permitted
under applicable privacy and data protection laws. These laws
vary from country to country, and the laws of more than 1
country may apply. Licensee should consult legal counsel for
advice regarding Licensee’s obligations under privacy and
data protection laws.
Respecting choices
Licensee must respect guest privacy preferences, which include
email delivery preferences.
Access
Licensee must promptly forward to art’otel any individual’s
request for access to his or her guest data, and co-operate with
art’otel, as art’otel may reasonably require, to respond to the
guest’s request.
Retention
Where (local) data protection laws do not impose a maximum
length of storage of data, and such laws must at all times be
complied with, Licensee must return or securely dispose of (i.e.,
shred, securely wipe or degauss) all paper or electronic media
containing art’otel guest data that is not stored in the property
management system if and when:
• It is no longer needed for the purposes for which it was
provided to you
• art’otel requests that you do so
• Licensee ceases to be an art’otel Licensee
Security
Licensee must develop, implement, maintain, assess and update
appropriate administrative, technical and physical safeguards
to protect the confidentiality, security and integrity of art’otel
guest data. This includes acquiring and maintaining PCI
compliance.
Sharing
Licensee may not disclose art’otel guest data without the written
consent of the guest, except that you may disclose guest data:
• To Team Members who have a need to know to perform
their duties, and who have been made aware of their
responsibility to protect the confidentiality and security of
guest data; and
• To Team Members, contractors and service providers who
have a need to know to perform services on your behalf,
provided they are legally bound by obligations comparable
to those set forth in these terms and conditions, to the extent
required by applicable law, subpoena, court order or other
legal process, provided you have the guests’ written
approval; and
• Given art’otel prior written notice of the required
disclosure and the opportunity, if reasonably possible,
to contest the required disclosure; and
• You have, to the extent reasonably possible, taken
measures to limit the disclosure, and protect the
confidentiality and security of the information requested
International Transfers
You may not transfer art’otel guest data to another country
without taking adequate measures to protect the guest data in
accordance with applicable laws.
Enforcement
You must promptly notify art’otel of any complaints received,
and any notices of investigation or non-compliance received
from any governmental or regulatory authority or agency
related to the processing of guest data, and co-operate with
art’otel with respect to any such complaint or investigation.
The less arty issues
–