GDPR Privacy Policy for Hotel Business
Effective Date︓ 1/6/2020
Revision Date︓29/3/2024
If you are accessing this website from other than the EEA or the UK, please read our general privacy
policy here.

1. About this Privacy Policy
This privacy policy (hereinafter referred to as the “Policy”) is for our customers residing in the European
Economic Area (“EEA”) or the United Kingdom (“UK”). This Policy explains how we collect, use andprotect your personal data in accordance with the EU and UK General Data Protection Regulation (the“GDPR”) when we provide you with our hotel services.

2. Controller
Keihan Hotels & Resorts Co., Ltd (hereinafter referred to as the “we,” “our” and “us”) is the controller
in the meaning of the GDPR and we are responsible for the processing of your personal data as
described below. Our contact details:
Keihan Hotels & Resorts Co., Ltd.
Address: 680 Higashi Shiokoji-cho, Shimogyo-ku, Kyoto 600-8216 Japan
TEL: 075-361-3221

FAX: 075-361-2910

Email: brandpr@ml.keihanhotels-resorts.co.jp

3. How and From Whom We Collect Your Personal Data
We collect your personal data either directly from you or indirectly from our travel agencies throughwhich your booking is made.

4. Purposes and Legal Bases for Processing Personal Data
We process the following categories of your personal data for the respective purpose with the respective
legal basis as described below.
PurposeCategories of Your Personal

Legal Basis

Data We Process(1)

To manage yourYour basic information, including

The necessity of thebooking withyour name, region of residence,

processing to takeour hotel.

nationality, address, gender,

steps at the request

telephone number, (fax number),of you prior to(date of birth), (age), (date ofmarriage), (e-mail address),entering into a(place of work), (address ofcontract.

work), booking date, check-in
date, check-out date, room
number, room price, passportnumber, (food to avoid), andother information necessary forthis purpose.
*We only obtain the informationin parentheses when you bookcertain special services such as
weddings, company trips, ormeals.
(2)

To provide ourYour basic information, including

The necessity of theguests with our

your name, region of residence,

processing for thenationality, address, gender,

performance of atelephone number, (fax number),

contract.

services,
includingaccommodation,
meals,(date of birth), (age), (date ofconference,

marriage), (e-mail address),relaxation ,(place of work), (address ofparking,transportation,laundry, etc.

work), booking date, check-in
date, check-out date, room
number, room price, passportnumber, (food to avoid),(occupation), and otherinformation necessary for thispurpose.
*We only obtain the informationin parentheses when you bookcertain special services such as
weddings, company trips, ormeals.

(3)To provideYour basic information, including

The necessity of thevarious services

your name, region of residence,

processing to takenationality, address, gender,

steps at the request

telephone number, (fax number),of you prior toreservations,(date of birth), (age), (date ofentering into a

touristmarriage), (e-mail address),

contract.

information,(place of work), (address of

to our guests,
includingrestaurant

etc.

work), booking date, check-in
date, check-out date, room
number, room price, passportnumber, (food to avoid), andother information necessary forthis purpose.
*We only obtain the informationin parentheses when you bookcertain special services such as
weddings, company trips, ormeals.

(4)

To manage ourYour basic information, including

The necessity of theregister ofyour name, address, contact

processing for our

information, (nationality),

legitimate interest in(passport number), and othermanaging the register

information considered necessaryof lodgers inby the prefectural governors suchaccordance with theas gender, age, previous place ofHotel Business Act ofstay, destination place, arrival

Japan.

lodgers

date and time, departure date
and time, and room number.
*We only obtain the informationin parentheses for foreign
nationals who do not have anaddress in Japan.

(5)To manageYour basic information, including

The necessity of themembership

your name, region of residence,

processing for thenationality, e-mail address,

performance of aaddress, gender, telephone

contract.

services for ourguestsnumber, date of birth, (place ofwork), (address of work), andother information necessary forthis purpose.
* We only obtain the informationin parentheses from legal entities.
(6)

To manage ourYour basic information, including

marketingyour name, region of residence,

activities

Your consent.

nationality, address, gender,
telephone number, (fax number),(date of birth), (age), (date of
marriage), (e-mail address),(place of work), (address ofwork), reservation date, check-in
date, check-out date, room
number, room price, passportnumber, (food to avoid),(occupation) and otherinformation necessary for thispurpose.
*We only obtain the informationin parenthesis for specificcustomers.

(7)

To conduct

Information obtained throughdigitaldevice identifiers (e.g. cookies),

marketingactivities,
includingpromotional

including browser identification
information, website browsing
history, and other informationnecessary for this purpose.

Your consent.

activities suchas providing
information
about upcoming
events anddiscount onservices
through social
media or digitaladvertisement.
(8)

To maintain the

Information obtained throughThe necessity of the

security anddevice identifiers (e.g. cookies),

processing for our

including browser identification

legitimate interest in

information, website browsing

managing the website

history, and other necessary forsecurity andthis purpose.

maintaining normal

properfunctioning of
our website
throughmanagement of
website visit

functionality of oursessions (log-in

website.

status),languagesetting, etc.
(9)

To respond to

Information contained in yourThe necessity of the

your inquiries

opinions and requests such as:processing for ourand to improve
our services
based on youropinions andrequests, etc.

- your namelegitimate interest in- age

responding to your- e-mail addressinquiries and- telephone number

improving our- address

services.

- gender(10) To establish,

Personal data including your basic

The necessity of theexercise and/or

information necessary for thisprocessing for our

defend our

purpose.

legitimate interest in

rights.

asserting, proving, or
defending our rights.

You may choose not to provide your personal data; in such cases, however, we may not be able tooffer accommodation or other services to you. Additionally, we may not be able to send you promotional
emails.

5. Sensitive Personal Data
We may collect your personal data that is classified as sensitive personal data under GDPR to provide
you with appropriate services, including specific restrictions on meals. In such instances, we will obtainyour consent or take appropriate measures in accordance with GDPR. If you provide us with sensitive
personal data through our website forms or otherwise, you will be deemed to have given us yourconsent.

6. Security Measures to Protect Personal Data
We will take the following security measures in managing your personal data.
1. Formulation of the basic policy
We have formulated the Basic Policy (the Personal Data Management Regulations) to ensure
our compliance with relevant laws and regulations in handling personal data.
2. Establishment of rules for handling personal data
We have established the rules and regulations to ensure the protection of personal data at eachstage of the collection, use, storage, provision, deletion and disposal of personal data, settingout the methods of handling, responsible persons and persons in charge and their duties.
3. Organisational security measures
We have appointed the Chief Privacy Officer as our chief officer in charge of personal dataprotection, and the Chief Data Protection Managers and Data Protection Managers in eachdepartment who handles personal data. The Chief Privacy Officer limits the number of persons
who can access personal data, manages the access privileges, prepares a record to monitor the
status of personal data processing, and conducts periodic self-inspections. In addition, we haveappointed the Chief Audit Officer to carry out audits on our handling of personal data. We havealso established a system to respond to any possible data leakages.
4. Security measures regarding personnel
We provide our employees with regular education and training on information security, including
precautions regarding the handling of personal data. In addition, we require all employees who
handle personal data to sign a confidentiality pledge.
5. Physical security measures
Regarding the offices where equipment handling personal data is installed, we have
implemented controls such as locking and restricting access to it only to the relevant persons.
6. Technical security measures
We limit the persons who can access to personal data and personal information databases they
can handle by setting and managing access privileges, and we take measures such as encrypting
personal data where necessary. In addition, we have set up a system for recording and analyzing

access to personal data, and we monitor this system to prevent and detect leaks, etc. of personaldata.
7. Understanding of foreign legal environments
We implement security measures based on our research and understanding of relevant laws
and regulations concerning the protection of personal data in countries where your personal
data is stored.

7. Retention Period of Personal Data
We will retain your personal data for as long as it is necessary for the purposes described in Section 4.
When the retention period of personal data has expired, we will delete or anonymize it within areasonable period in a secure manner.

8. Disclosure of Personal Data to Third Parties
We may disclose your personal data to third parties for as long as necessary for the purposes described
below. If our processing of personal data goes beyond the scope of the legal basis specified in Section
4, we will obtain your consent or complete other necessary procedures to conform with GDPR before
disclosing it.
Categories of personal data
to be disclosed

Recipients

Purposes of disclosure

Categories listed in Section

Our service providers

Purposes (1) and (2) in

4 (1) and (2) aboveof the hotel

Section 4 above

management systems
and site controller
services to store or
manage reservation
information, etc.
obtained from you
Categories listed in Section

Third party business

Purposes (3) in Section 4

4 (3) above

entities we use to

above

provide services suchas meal reservations
and information on
tourist attractions to
our customers (e.g.,
restaurants and travelorganizers)

Categories listed in Section

・Related

Purposes (4) in Section 4

4 (4) above

governmental agencies

above

to whom we are
required to disclose ourregister of lodgers inaccordance with theHotel Business Act ofJapan・Our service providersof the hotelmanagement systems
to store or manage
personal data obtained
from you
Categories listed in Section

Advertising technology

Purposes (7) in Section 4

4 (7) above

companies

above

Categories listed in Section

Our service providers

Purposes (8) in Section 4

4 (8) above

operating andabove

maintaining our
websiteCategories listed in Section

Court or other dispute

Purposes (10) in Section

4 (10) above

resolution

4 aboveorganizations,
attorneys, etc. that we
use to execute ourcontracts with you andto assert, prove, ordefend our rights inlegal disputes

9. Cross-Border Transfer of Personal Data
Our disclosure of your personal data to third parties may constitute cross-border transfer of personal
data. When we transfer your personal data to a country or region other than the EEA member countries
or the UK, we either rely on adequate decisions made by the European Commission or the UK
government, use the Standard Contractual Clauses (SCCs) adopted by the European Commission, theInternational Data Transfer Agreement (IDTA) or the International Data Transfer Addendum to theEuropean Commission's SCCs approved by the UK Parliament, or take other necessary measures toprotect your personal data.
s

10. Your Rights
You have the following rights set out in the GDPR with the processing of your personal data by us. You
may exercise the rights by contacting us via the Point of Contact below. We generally respond to you
within one month after receiving your request and verifying your identification unless there are any ofthe exceptions set out in the GDPR and applicable laws and regulations.
(1) Withdrawal of consent: You can revoke at any time previously given consent to our processing ofyour personal data.
(2) Right of access (we disclose information including purposes to process, categories of personal data,
recipients to disclose, retention period, sources to collect): You have the rights to make an inquiry,
to review and to request us for copies of your personal data we hold.
(3) Right to rectification: You have the right to request us to correct any of your personal data we holdwhich you believe is inaccurate. You also have the right to request us to complete your personal
data we hold which you believe is incomplete.
(4) Right to erasure: You have the right to request that we erase your personal data, under certain
conditions.
(5) Right to restrict processing: You have the right to request that we restrict the processing of yourpersonal data, under certain conditions.
(6) Right to object to processing: You have the right to object to our processing of your personal data,
subject to certain conditions as set out in Section 11.
(7) Right to data portability: You have the right to receive your personal data, which you have provided
to us, in a structured, commonly used and machine-readable format and have the right to transmit
those data to another controller.

11. Right to Object to Processing
You have the right to object at any time to the processing of your personal data on the basis of ourlegitimate interests. Please contact us if you wish to exercise this right.

12. Lodging Complaint with Data Protection Authority
In accordance with the GDPR, you have the right to lodge complaints about how we process yourpersonal data with competent data protection supervisory authority. However, we appreciate theopportunity to address your concerns before you lodge a complaint to the data protection supervisory
authority. We kindly request that you consider contacting us through the Point of Contact below in
Section 13.

13. Point of Contact
We have appointed DataRep as our data protection representative in the EEA and the UK. Please contact
the representative by either of the following channels. Please visit this URL for information on how tocontact the representative.
Email: datarequest@datarep.com
Webform: www.datarep.com/data-request
Postal mail: Please mail your inquiry to the representative at the address listed on this URL,
whichever is most convenient for you.

14. Update of this Policy
We may update this Policy to comply with amendments to the GDPR and applicable laws and regulations.
If we update this Policy, we will post it on our website without delay and announce the revision date.