Privacy Policy

Depending on how you interact with us, we may collect the following categories of personal data.

Contact and enquiry information may include:

• name;
• email address;
• telephone number;
• enquiry or message;
• preferred accommodation type;
• intended stay dates; and
• other information you voluntarily provide to us.

Booking and stay information may include:

• guest name;
• contact information;
• nationality;
• arrival and departure dates;
• accommodation booked;
• number and details of accompanying guests where required;
• booking history;
• special requests or accessibility requirements;
• payment and transaction information;
• invoices and billing records;
• communications relating to your stay; and
• information concerning incidents, complaints, damage, security or operational matters where relevant.

We aim to collect only information that is reasonably necessary for the relevant accommodation, legal, security or operational purpose.

Hong Kong law requires persons staying in certain lodging or sleeping accommodation provided for reward to provide specified information.

Where applicable, persons staying at our accommodation may be required to provide information required under Hong Kong law, including information required for guest registration and immigration-related records.

Where we collect information to comply with statutory requirements, providing the required information may be mandatory. Failure to provide it may affect our ability to provide accommodation or complete check-in.

We may request or inspect identification documents where reasonably necessary for:

• identity verification;
• check-in;
• guest registration;
• fraud prevention;
• security;
• compliance with applicable law; or
• another purpose directly related to your stay.

We seek to avoid collecting or retaining more identity information than is reasonably necessary for the relevant purpose.

Where less privacy-intrusive means of identity verification are practicable, we may use those methods instead.

Payments may be processed by banks, card networks, payment gateways or other payment service providers.

Nesphere may receive transaction information such as:

• payment status;
• transaction reference;
• amount;
• payment method; and
• limited payment-related information necessary for reconciliation, refunds or disputes.

We do not intend to store full payment-card details in our own customer database where payment information is processed securely by our payment service providers.

When you use our website, we or our technology providers may collect limited technical information such as:

• IP address;
• browser type;
• device type;
• operating system;
• pages viewed;
• referring page;
• date and time of access;
• website interaction information; and
• cookie or similar technology identifiers.

We may use this information for:

• operating the website;
• security and fraud prevention;
• performance monitoring;
• troubleshooting;
• analytics; and
• improving the website and guest experience.

Where required, cookie or analytics preferences will be handled through the relevant website controls.

CCTV may operate in common areas of properties for legitimate security, safety, crime-prevention, incident-investigation and property-management purposes.

CCTV is not intended to monitor guests inside private accommodation.

Where CCTV is used, appropriate notices should be displayed. Recordings will be protected against unauthorised access and retained only for a reasonable period having regard to the purpose for which they were collected, except where longer retention is required in connection with an incident, investigation, legal claim or legal requirement.

We may also maintain limited building or room access records, including electronic access logs, where reasonably necessary for guest safety, access administration or investigation of incidents.

We may use personal data for purposes including:

• responding to enquiries;
• providing quotations;
• processing and managing reservations;
• providing hotel or serviced-apartment accommodation;
• guest registration and check-in;
• communicating before, during and after a stay;
• providing housekeeping and guest services;
• administering access to rooms and facilities;
• processing payments, refunds and deposits;
• issuing invoices and receipts;
• responding to complaints and service requests;
• protecting guests, staff and property;
• investigating suspected fraud, misconduct, security events or damage;
• maintaining accounting and business records;
• complying with legal, regulatory, licensing, tax and law-enforcement requirements;
• maintaining and improving our website and services; and
• conducting direct marketing only where permitted and where the required consent has been obtained.

We will not normally use personal data for a new purpose unrelated to the purpose for which it was collected without the prescribed consent of the individual, unless otherwise permitted by law.

If you submit a Contact Form, we may use the information provided to:

• respond to your enquiry;
• contact you about the accommodation or service you asked about;
• keep an appropriate record of the enquiry; and
• provide related customer service.

Submitting a Contact Form does not automatically subscribe you to marketing communications.

If you separately choose to receive Nesphere news and promotional communications, we will record that marketing preference independently.

If you provide an email address to request a promotional or discount code, we may use that email address to:

• verify or administer the request;
• send you the requested code;
• prevent abuse or repeated misuse of an offer;
• maintain an appropriate transaction record; and
• administer the relevant promotion.

Requesting a discount code does not by itself constitute consent to receive future marketing.

Where we offer an optional marketing checkbox, you may choose whether to subscribe without affecting your eligibility to receive the requested offer, subject to the applicable promotion terms.

If you expressly subscribe to our newsletter or separately opt in to marketing communications, we may use information such as your name, where available, and email address to send:

• Nesphere news;
• hotel and serviced-apartment offers;
• accommodation promotions;
• seasonal campaigns;
• availability or product updates; and
• related accommodation and hospitality information.

We will not treat silence, submission of an enquiry, a booking, or a request for a discount code as consent to direct marketing.

You may unsubscribe at any time, free of charge, by using the unsubscribe facility in our marketing emails or contacting us.

Once you unsubscribe, we may retain a limited suppression record so that your marketing preference continues to be respected.

Where reasonably necessary for the purposes described in this Policy, personal data may be disclosed to or processed by categories of recipients including:

• accommodation management and operations personnel;
• booking and property-management system providers;
• payment processors, financial institutions and card networks;
• email and communications service providers;
• website hosting, cloud infrastructure and database providers;
• IT, security and technical-support providers;
• housekeeping, maintenance or service contractors where necessary;
• professional advisers, auditors, insurers and legal advisers;
• booking channels or travel partners involved in your reservation;
• government departments, regulatory authorities, police, immigration or other authorised bodies where required or permitted by law; and
• other service providers acting on our behalf.

Service providers are expected to process personal data only for authorised purposes and with appropriate confidentiality and security protections.

Nesphere does not sell personal data to advertisers.

We will not provide your personal data to another organisation for that organisation’s own direct marketing unless the applicable requirements of the PDPO have been satisfied.

Some of our technology or service providers may process or store information outside Hong Kong.

Where personal data is transferred or processed outside Hong Kong, we will take reasonable steps, including contractual, technical and organisational safeguards where appropriate, to maintain protection consistent with our obligations under the PDPO.

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, or as required by applicable legal, regulatory, accounting or operational requirements.

Different categories of information may therefore have different retention periods.

For example:

• guest-registration information will be retained for the period required by applicable law;
• accounting and business records will be retained for the period required under applicable tax and accounting laws;
• CCTV and access records should normally be retained only for a limited period appropriate to their security purpose, unless needed for an incident or legal matter;
• marketing subscription and suppression information may be kept for as long as reasonably necessary to administer your subscription or ensure that an opt-out request continues to be respected; and
• enquiry records will be retained only for an appropriate period having regard to the nature of the enquiry and any subsequent relationship with us.

Where information is no longer required, we will take reasonable steps to delete, anonymise or securely dispose of it.

We take practicable technical and organisational measures to protect personal data against:

• unauthorised access;
• accidental loss;
• misuse;
• alteration;
• disclosure;
• erasure; and
• unauthorised processing.

Measures may include appropriate access controls, authentication, encryption where appropriate, system monitoring, restricted staff access, secure cloud services and contractual protections for service providers.

No internet or electronic storage system is completely secure, but we seek to apply safeguards appropriate to the nature and sensitivity of the personal data we hold.

We take reasonable steps to maintain accurate personal data having regard to the purpose for which it is used.

You should notify us if information you have provided changes or is inaccurate.

Under the PDPO, you may request:

• confirmation as to whether we hold your personal data;
• access to personal data held about you; and
• correction of inaccurate personal data.

Requests will be handled in accordance with applicable requirements under the PDPO.

Our accommodation services may be used by families and guests travelling with children.

Where information about a child or minor is reasonably required for a booking, guest registration, safety or accommodation purpose, we will seek to collect only information reasonably necessary for that purpose.

Where appropriate, information should be provided by or with the involvement of a parent, guardian or responsible adult.

Our website may contain links to websites, booking platforms or services operated by third parties.

Their collection and use of personal information is governed by their own privacy practices, and Nesphere is not responsible for the privacy practices of independent third-party websites.

We may update this Privacy Policy from time to time to reflect:

• changes in our services;
• new systems or service providers;
• changes in our privacy practices; or
• legal or regulatory developments.

The updated version will be published on this page.

For privacy enquiries, requests for access or correction, or requests relating to direct marketing, please contact:

Nesphere Management Company Limited
Email: info@nespheregroup.com
Address: 310 King’s Road, North Point, Hong Kong

We will handle privacy enquiries and requests in accordance with applicable Hong Kong law.