Last updated: 5 August 2019

References to "our", "us" or "we" within this policy are to Jumeirah International LLC.

This Privacy Policy governs the collection and use of personal information by Jumeirah. For more information about Jumeirah please see: www.jumeirah.com.

We are committed to protecting and respecting your privacy. This Privacy Policy explains the types of personal information we collect, how we use that personal information, who we share it with, transfers to other countries, how we protect that information, and your legal rights in relation to your personal information. We are committed to abiding by this Privacy Policy, as well as the requirements of applicable laws, in the operation of our business.

Please read the following carefully as it explains our views and practices regarding your personal information, and how it is handled. By accessing or browsing our website or using our services or facilities, you confirm that you have read this Privacy Policy in its entirety. Please do not use Jumeirah’s website and services if you do not accept it. This does not mean we are asking you for a consent (under data protection law) for everything that is described in this Privacy Policy. If we need your consent we will ask for that separately. If you do not accept the practices described in this Privacy Policy, you should not use our website or our services or facilities.

In some parts of this Privacy Policy we refer to the Jumeirah group of companies. Here is a list of subsidiaries of Jumeirah’s parent company, Dubai Holding co:

TECOM Group an industry-specialized developer and operator of Dubai’s leading business communities
Dubai Properties one of the largest fully integrated real estate companies in Dubai
Arab Media Group one of the region’s leading media and entertainment organizations
Dubai Asset Management manages a diverse portfolio of resident focus communities for rent
Dubai Retail manages an extensive range of retail assets across destinations and communities

If you would like a list of all companies in the group please ask and we will provide it - see ‘Contacting us’ below.

Click on one of the links below to jump to a specific section:

Who we are
Information covered by this Privacy Policy
Important information about marketing
What information do we collect from you?
How do we use your personal information?
Who do we share your personal information with?
Profiling by Dubai Holding co. and its marketing communications Where we store your personal information/transfers
Monitoring (including recordings) of emails and telephone calls
CCTV
Security of personal information
Third party websites and apps
Your rights
How to withdraw consent
Contacting us
Cookies Policy
How long do we keep your personal information?
Children
Data anonymisation and use of aggregated information
Changes to this Privacy Policy
Jumeirah social media policy

Who we are

For the purpose of applicable data protection laws, the data controller is Jumeirah International LLC of PO Box 73137, Dubai, United Arab Emirates.

If you use our facilities and services, the entity which manages the relevant facility or service ("Country Manager") will also be a data controller in respect of your personal information. A list of such facilities and services and the respective Country Managers can be found here.

We have a data protection officer (DPO) and you can contact our DPO. See ‘Contacting Us’ below for how to do this.

Information covered by this Privacy Policy

This Privacy Policy covers all personal information collected and used by Jumeirah. In this Privacy Policy, "personal information" means information that (either in isolation or in combination with other information held by us) enables you to be identified as an individual or recognised directly or indirectly. This will generally include your name, date of birth, nationality, gender, postal address, email address, phone number, credit card number, details of the preferences you express to us during your stay at one of our hotels (e.g. room type) dietary requirements, and technical information from the devices you use to access our website (further details below). In addition, we will ask you for a copy of your passport or other form of identification when you arrive at our hotels.

In this Privacy Policy we refer to ‘processing’ of your personal information. This is a legal term. We want to make sure you can understand what it means. Process or processing includes everything we do with your personal information from its collection, right through to its destruction or deletion when we no longer need it. This includes for instance collecting it (from you), obtaining it (from other organisations), using, sharing, storing, retaining, deleting, destroying, transferring it to other countries.

‘Legitimate interests’ is mentioned in this Privacy Policy because data protection laws allow the processing of personal information where the purpose is legitimate and is not outweighed by your interests, fundamental rights and freedoms. Under data protection laws this is called the ‘legitimate interests’ legal basis for justifying the use of personal information.

Important information about marketing

When you are asked to give permissions for marketing you will be directed to this section of our Privacy Policy by a link. Here is the full detail which you must read before you decide whether you wish to subscribe:

Part 1: This is what you must read before you decide whether to tick the box about marketing from us:

We would like to provide you with information about Jumeirah’s products and services, including offers and promotional materials. You can opt-out of receiving further marketing at any time by using the unsubscribe link in each email.

Part 2: This is what you must read before you decide whether to tick the box about marketing from Jumeirah’s parent company, Dubai Holding co., on its products and services or those of or its subsidiaries named here:

TECOM Group an industry-specialized developer and operator of Dubai’s leading business communities
Dubai Properties one of the largest fully integrated real estate companies in Dubai
Arab Media Group one of the region’s leading media and entertainment organizations
Dubai Asset Management manages a diverse portfolio of resident focus communities for rent
Dubai Retail manages an extensive range of retail assets across destinations and communities

You can opt out of receiving further marketing at any time by using the unsubscribe link in each email.

Please read Dubai Holding’s privacy notice for further information on how it processes your personal data.

What information do we collect from you?

We (Jumeirah International LLC) will be collecting personal information at every touch point or guest interaction. We will generally collect information about you from the different sources as detailed below (some of these will not be relevant to you specifically).

Information you give us

You will need to provide information to us in relation to your reservation, stay or visit to a Jumeirah facility. Otherwise we will not be able to service you properly when you are our guest.

You can also choose to give us information about yourself when you respond to a communication from us or by filling in forms (both online and offline), over the telephone and through written correspondence with us (e.g. in relation to guest registration cards, spa and fitness club membership applications, loyalty enrolment forms, or online booking forms).

The information you give us will generally include your name, postal address, email address, date of birth, payment card information, landline and/or mobile telephone number, preferences (e.g. room type), general feedback on your stay, dietary requirements, allergies, as well as other personal information. In addition, please refer to the list of personal information above (including your passport or other ID).

Information we collect about you

We will collect information about your use of our facilities and services, your preferences in this regard, and details of purchases and bookings you make with us or which are made for you.

When you visit our website, we will use cookies and other technologies to automatically collect the following information:

technical information, including the Internet Protocol (IP) address used to connect your computer to the internet, your login information, browser type and version, device identifier, location and time zone setting, browser plug-in types and versions, operating system and platform, page response times, and download errors;
information about your visit, including the full Uniform Resource Locators (URL) clickstreams to, on and from our websites;
length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouseovers) and methods used to browse away from the page.

IP addresses and other online identifiers (i.e. those listed above) are your personal information. This means that you have the same rights under data protection laws in relation to these as you do with other personal information. For information about rights see below.

Information we receive and collect from other sources:

We will (except if you are unknown to Jumeirah group) receive information about you from other websites operated by the Jumeirah group or from the other services that we provide. We also work closely with third parties such as airlines, travel agents, tour operators and third party agents and will (except if you are unknown to them) receive information about you from them. We will (if permitted by data protection laws) also collect information about you from publicly available sources, including publicly available content on social media (consistent with your settings on such services) and (if you are a business traveler) publicly available directories such as LinkedIn. We will also collect information about you in relation to your booking from your employer or the business for which you work (if you are travelling on business).

Other companies in the Jumeirah group will share your personal information with us (if permitted by data protection laws). For example, if you contact a different Jumeirah company from us to stop all marketing from all parts of Jumeirah – that company will need to tell us so that we can respect your preferences.

Cookies Policy

Please read our separate Jumeirah Cookies Policy. or our JClub Cookies Policy.

How do we use your personal information?

Data protection laws require us to explain the legal basis to justify our processing of your personal information for clearly explained purposes. For some processing (though not where we rely on a consent) more than one legal basis will be relevant.

In this table we refer to ‘Profiling’. This means any form of automated processing of your personal information to evaluate certain personal aspects about you, such as to analyse or predict aspects concerning your economic situation, personal preferences, interests, reliability, behaviour, location or movements. There are two types of Profiling. One type has a legal or other significant effect on you (eg. where different prices are given to different people) and we do not do this type of Profiling activity at this time. The other type of Profiling does not have a legal or other significant effect on you. This is the type we do. This helps us to tailor our marketing to you.

We will use your personal information to:	How do we use personal information for this purpose?	What is the legal basis for us processing your information in this way?
Provide you with services you request from Jumeirah, such as spa or gym services, concierge services, hotel bookings etc.	We will need to use your personal information where this is necessary for us to perform our obligations under a contract with you, for example where you have requested use of our spa or gym facilities or have made a booking at one of our hotels.	Using your personal information in this way is necessary for us to perform our contractual obligations to you. Unless your booking came via your employer or the business for which you work – in this case our legal basis is the legitimate interest we have in complying with the contractual obligations we have with your employer/the business
Complete bookings you make through our website, such as hotel, spa and restaurant bookings.	We will need to use your personal information (such as your email address or dietary requirements) to assist you with any bookings you have made through our website.	Using your personal information in this way is necessary for us to perform our contractual obligations to you or the contractual obligations we owe to your employer/the business.
Manage your membership of the Jumeirah Sirius and/or the isme by Jumeirah programmes (our recognition and rewards programme).	We will need to use your personal information (such as your name, date of birth, telephone number and email and postal address) to administer the Jumeirah Sirius and isme by Jumeirah programmes, to communicate with you about the programmes, and to send you news of related special offers and promotions.	Using your personal information in this way is necessary for us to perform our contractual obligations to you or the contractual obligations we owe to your employer/the business. Where contacting you to send you news of special offers and promotions, to the extent required by applicable law, we will ask for your consent before processing your information in this way.
Send you our Newsletter.	When you type in your contact details on our Newsletter sign up page you are asked to click on ‘subscribe’.	The click you do means we send you our Newsletter only with your consent.
To contact you for direct marketing ie. to provide you with information about Jumeirah's services and latest offers. To do Profiling which allows us to tailor our direct marketing communications and promotions to your interests. This includes Profiling that is based on your browsing history on our website and purchase history. The data from your existing booking is analysed and then an offer will be especially designed for you to give you an opportunity to have a more premium experience whenever available. We use information about your stay history and/or your booking history to select guests for this type of offer. We use information such as the booking channel, the rate code, the region from where the booking is made, length of stay, and the number of days in advance the booking is made. It is only this data as related to your current booking that is used. We do not use historical bookings data for this.	We will need to use your personal information (such as your email address or other contact details) to send you information about Jumeirah’s latest offers that you may be interested in on the basis they are tailored to your interests. Please note we may also share your personal information with other entities in the Jumeirah group for this purpose.	As for our other direct marketing (i.e. not our Newsletter) , it is in our legitimate interests to use your contact information and other personal information we receive and collect about you to send you details of Jumeirah’s latest services and offers that may be of interest to you, provided this is in line with your marketing preferences. To the extent required by applicable law, we will ask for your consent before processing your information in this way. The Profiling we have described here is based on our legitimate interests of making sure that our marketing communications are tailored to what you are interested in based on how you use our website and your purchase history. Direct marketing from Dubai Holding Group companies requires your consent (see ‘Profiling by Dubai Holding co. and its marketing communications’ below).
Combine information we receive and collect (e.g. from your requests, preferences and purchase history) to understand your interests and preferences and provide you with a more personalised experience. This is a type of Profiling.	We will combine the information we receive and collect about you to better understand your interests and preferences, so that we can provide you with an experience that is tailored to those interests and preferences. For example, we will do this by offering you use of certain facilities (such as spas and gyms) that you are most likely to be interested in, or sending you personalised offers or promotions by email (where you have agreed to receive our emails), or offering you advertising content that is relevant to your interests.	It is in our legitimate interests to personalise our services and advertising for you to better meet your needs as a customer, and to ensure that we provide the best service possible to our customers, provided this is in line with your marketing choices. We will look at your preferences that we derive from your purchase history and the preferences you communicate to us so that we can achieve this.
Comply with legal requirements and exercise or defend legal claims.	We will sometimes need to process personal information to comply with legal requirements to which we are subject (for example in relation to health and safety).	It is in our legitimate interests to process personal information for the purposes of exercising and defending legal rights or defending legal claims. Processing personal information in this way is also necessary to ensure compliance with the Jumeirah group's legal obligations.
Process your payments and protect against fraudulent transactions.	We will need to process your personal information in order to keep your payments safe and secure and protect against fraudulent transactions.	It is in our legitimate interests to process personal information to keep our customers' payments secure and to prevent fraud. Processing personal information in this way is also necessary to ensure compliance with the Jumeirah group's legal obligations.
Process your personal information where this is necessary to keep our website safe and secure.	We will need to process your personal information in order to keep our website safe and secure and protect against illegal or fraudulent activity such as cyber attacks.	It is in our legitimate interests to monitor how our website is used to detect and prevent fraud, other crimes and the misuse of our website. This helps us to ensure that you can safely use our website.
Process your IP address and other online identifiers (see above for the list of these).	We will do this to improve your user experience when you are on our website. This includes ‘remembering you’ when you sign in each time (if you select that option). This also includes seeing the ways in which you navigate our website and seeing which pages are of interest to you. This also includes the Profiling that we have described in other rows of this table. We use your IP address and other online identifiers for that Profiling.	This is for our legitimate interests in doing what is described here. For our legitimate interests relevant to Profiling please refer to the other rows in this table.
Keep an up to date suppression list where you have asked not to be contacted, so we do not inadvertently re-contact you.	We understand that you may prefer for us not to contact you with details of our products, services, or promotions. We keep records of your preferences to ensure that we do not contact you if you have asked us not to. We may need to process certain of your personal information (such as your name and email address) in order to do this.	It is in our legitimate interests to process personal information in order to maintain an up to date suppression list and ensure that we do not contact you where you have asked us not to. Processing personal information in this way is also necessary to ensure compliance with the data protection laws (legal obligations).
To contact you on social media if you have abandoned your cart – to see if you do wish to continue with your booking.	If you move a booking into the cart on our website, then abandon the page, we will (if data protection laws permit this) contact you using your profile on social media pages to ask if you want to continue with your booking or not. If you do – we will leave it in your cart. If you do not – then we will remove it from your cart so you would not see it next time you visit our website.	We would only do this with your consent.
For management and audit of our business operations including accounting	We will use it to keep accurate records about our business and those records will be used when audits and tax accounting returns are compiled for our business.	This is for our legitimate interests in doing what is described here.
To adhere to guidance and best practice under the regimes of governmental and regulatory bodies relevant to our industry.	We will use it to adhere to this guidance and to adopt this best practice approach to how we run our business. For instance if new guidance is available about cyber security risks we might need to take steps to protect all personal information (including by processing it).	This is for our legitimate interests in doing what is described here.
To deal with complaints or questions from you.	We will use it to reply to your complaints or questions.	This is for our legitimate interests in doing what is described here.
To keep a record of all guests who are staying with us.	We will ask you for a copy of your passport or other form of identification when you arrive at our hotels.	This is for our legitimate interests in doing what is described here. This processing is also for compliance with legal obligations. We will only retain these copies for as long as is necessary and in accordance with our retention policies. All such information will be held securely in accordance with data protection laws.
To take account of dietary requirements and allergies you have or other health requirements which are relevant to your dining. This will all be relevant if you are dining in our restaurants and when you are staying in our hotels.	We will ask for this information. You have a choice whether to provide it to us.	This means we rely on your consent to process this personal information about you.
To take account of your disability access needs or your other special requirements. For instance if you require a particular room when you are staying with us or if you require anything specific when you are dining with us.	To make sure you have a comfortable stay with us.	This is for our legitimate interests of doing what is described here. This processing is also for compliance with legal obligations. If we need a consent from you for this we will ask for it. Otherwise we will be relying on what are called ‘substantial public interest grounds’. We rely on this legal basis where this helps us to meet our broader social obligations.
For our hotel wifi service	When you use WiFi service at our properties, we will need to ask you to input your personal information which we will share with third parties such as authentication gateway partners and WiFi service providers to facilitate your use of the WiFi service; to remember your registration information; for technical support purposes; and for service improvements and analytics. This will include: name, room number, and device information (including operating system/version, hardware model and unique device identifiers such as MAC address).	This is for our legitimate interests in providing our guests with a WiFi service at our properties.

Who do we share your personal information with?

Jumeirah group of companies
We will share your personal information sometimes with other members of the Jumeirah group of companies, including subsidiaries and holding companies, in order to enable you to request our services, to process your payments, understand your preferences, send you information about products and services that may be of interest to you and conduct the other activities described in this Privacy Policy. Some of those group companies will be located outside the European Economic Area ("EEA"), in which case the section "Where we store your data" below will apply.
Our group companies can only send you their own marketing communications with your consent. In addition, please see ‘Profiling from Dubai Holding co. and its marketing communications’ below.

Our service providers
We use other companies, agents or contractors ("Service Providers") to perform services on our behalf or to assist us with the provision of services to you. For example, we will usually engage Service Providers to provide concierge services, housekeeping and laundry services, marketing, advertising, communications, services in connection with your Jumeirah Sirius and/or isme by Jumeirah membership, to provide IT services including suppliers of website hosting services, to personalise and optimise our service, to analyse and enhance data (including data about users' interactions with our services), and to provide legal, accounting, insurance, audit and other professional services, to host personal information in data storage facilities. In the course of providing such services, these Service Providers will usually have access to your personal information. However, these Service Providers are contractually bound only to use personal information to perform the services that we hire them to provide. We will always use our best efforts to ensure that all the Service Providers we work with will keep your personal information secure.
Our legal basis for sharing your personal information with our Service Providers is legitimate interests. It is in our legitimate interests to engage these third parties to help us to run our business.

Our partners
We will (where data protection law permits this) share your personal information with our key partners, which include certain airlines and financial partners. For example, our airline Frequent Flyer Programmes enables our guests to earn miles for every stay, as well as benefit from exclusive special offers. Jumeirah also has relationships with other companies including financial and luxury brands, whereby our customers can also benefit from exclusive experiences with our partnerships. A list of such key partners can be found online at http://www.jumeirah.com/en/jumeirah-group/about-jumeirah-group/strategic-global-partnerships/. We will always use our best efforts to ensure that all partners we work with will keep your personal information secure.
Our legal basis for sharing your personal information with our key partners is legitimate interests (the legitimate interests of those partners and of our own) in enabling the Frequent Flyer Programmes and the other experiences mentioned above to operate and for you to enjoy these (if you are signed up for them).

Third parties permitted by law
In certain circumstances, we will be required to disclose or share your personal information in order to comply with a legal or regulatory obligation (for example, we could be required to disclose personal information to the police, counter-terrorist government authorities, or to judicial or administrative authorities).
We will also disclose your personal information to third parties in order to enforce our terms and conditions or other agreements, or to protect the rights, property or safety of the Jumeirah group or the public, where that is necessary and where data protection laws permit this.
Our legal basis for sharing your personal information with these third parties will be our legitimate interests (in complying with their requests for ourselves and Jumeirah group) or compliance with the Jumeirah group's legal obligations.

Third parties connected with business transfers
We will sometimes transfer your personal information to third parties in connection with a reorganisation, restructuring, merger, acquisition or transfer of assets, provided that the receiving party agrees to treat your personal information in a manner consistent with this Privacy Policy.
Our legal basis for sharing your personal information with these third parties will be our legitimate interests in being able to restructure and manage the Jumeirah businesses in this way.

Our legal counsel and other professional advisers
We will sometimes share your personal information with firms and companies who provide legal, tax, accountancy and audit related services to us.
Our legal basis for sharing your personal information with these third parties will be our legitimate interests in being able to properly manage the Jumeirah businesses and to seek professional advice in relation to those businesses. We are not the data controller of what these professional services firms and companies do with your personal information. They are data controllers. They are subject to strict professional services regulatory regimes and confidentiality requirements.

Profiling by Dubai Holding co. and its marketing communications

We are part of the Dubai Holding group and Dubai Holding co. is our parent company. Please see above for what ‘Profiling’ means. Where permitted under data protection laws, we will share your personal information with Dubai Holding co. and it will in turn share it with other companies in the Dubai Holding group. Dubai Holding co. and those other companies will do Profiling with your personal information about your bookings with us and how you use our website, in order to decide whether to up-sell to you. For example, if they think you might be interested in purchasing real estate based on your nationality, where you live, how frequently you stay in Jumeirah hotels and what your spend is when you are there, they might look to up-sell to you about Jumeirah real estate. Alternatively, they might wish to invite you to Jumeriah or Dubai Holding co. events or make certain offers to you which are not available to all Jumeirah customers (on the basis they wouldn’t be appealing or relevant to all customers).

Usually when they do this Profiling they will use a pseudonym instead of data which identifies you. That pseudonym is still your personal information but for security reasons it has been masked so that during Profiling you cannot be identified. Then when the outcome of the Profiling is known – the pseudonym will be linked back to you as an individual – and they will check whether they can lawfully send their marketing to you to up-sell based on what they have learnt about you from the Profiling.

Marketing from Dubai Holding co. and other companies in the Dubai Holding group who you do not have a customer relationship with already will only happen if you consent to this. This is the lawful basis for it under data protection laws. Since you are our customer, not theirs, they cannot send their direct marketing to you based on legitimate interests.

Dubai Holding co. (and these other companies) will be data controller for the use of your personal information described above. Their contact details will be within their marketing communications. If you wish to unsubscribe from their own marketing please use the unsubscribe link in their marketing messages.

Where we store your personal information/transfers

Some countries outside the EEA do have adequate protection for personal information by law. We process your personal information in Dubai. When you provide your personal information to us through this website there will necessarily be processing by us in Dubai, i.e. outside the EEA. Your personal information is protected when we do this processing because we are subject to UK and European Union data protection laws. Separately, when a Country Manager from inside the EEA sends personal information to us (Jumeirah International LLC) in Dubai that will be a transfer to outside the EEA. In addition, if we transfer your personal information to someone else who is located in one or more countries or territories outside the EEA (for instance, to our service providers located in the UAE, to the US, or to anywhere where we have a Jumeirah hotel or residence outside the EEA if you are staying there), that will be a transfer outside the EEA.

Where this is required by data protection laws, we will make sure that suitable safeguards are in place for transfers. Safeguards include EU standard contractual clauses (or equivalent measures) imposed on the recipients of your personal information which require the recipient to protect your personal information to the standard required in the UK/the European Union/the European Economic Area. For more information about EU standard contractual clauses (or equivalent measures) and how to obtain a copy of them or to find out where they have been made available you can contact us – see ‘Contacting Us’ below. Another type of safeguard is where the recipient of personal information is signed up to ‘international frameworks’ intended to enable secure data sharing and where the framework is the means of protection for the personal information. As an example - the US Privacy Shield framework.

Monitoring (including recordings) of emails and telephone calls

For our legitimate interests of ensuring the highest level of quality control and the best possible service for our guests we do record telephone calls and we will read emails coming in to our guest services teams. We do this to check that our guests are being serviced properly and in a timely manner. We do this to have a record of what we have discussed with you and actions agreed with you, and for quality control and staff training purposes. This involves processing of your personal information because your name and other identifiers will be mentioned on those calls/in those emails.

CCTV

For our legitimate interests of ensuring the safety and security of our guests and our staff we do use CCTV in the lobbies of our hotels, in all entrances, and in public areas such as our restaurants and lounges. CCTV signage will be in place where that is required by local laws or regulations.

Security of personal information

All information you provide to us via our website is stored on our secure servers. Any payment transactions carried out via our website will be encrypted using Transport Layer Security (TLS) technology.

Jumeirah has taken steps to safeguard the integrity of its communications and computing infrastructure, including by implementing authentication, monitoring, auditing, and encryption technology. Security measures have been integrated into the design, implementation, and day-to-day operations of this website as part of our continuing commitment to the security of electronic content and the electronic transmission of information. Despite our best efforts unfortunately the transmission of information via the internet is not completely secure. Although we have strict procedures and security measures in place, we cannot guarantee the security of your data transmitted to our site.

Third party websites and apps

Our websites may contain links to and from third party websites. Please note that if you follow a link to any of these websites, these websites will have their own terms of use and privacy policies and that we do not accept any responsibility of liability for these policies. Please check these policies before you submit any personal information to these websites.

Your rights

You have the following rights with respect to the personal information that we hold about you. They are relevant to us (Jumeirah International LLC) and to our relationship with individuals using our website and our processing of those individuals’ personal information because we are required to comply with the General Data Protection Regulation.

Please also note that these rights are not engaged in all circumstances. Some rights are only engaged (for example) where processing is based on your consent or on legitimate interests. If you send us your rights request, we will respond and explain whether or not rights are engaged in your own case.

Your right to access the information we hold about you

You can request access to the information we hold about you by contacting us using the contact details set out below. If possible, you should specify the type of information you would like to see – this will help us to ensure that our disclosure is in line with what you require. Our file of your information will usually be made available to you within 30 days of when we receive your request, although occasionally we may be able to extent this period (if that is relevant we will contact you to explain why). Occasionally we not be able to give you access to some of the personal information we hold about you (for example, we may not be able to give you access if it would unreasonably affect someone else's data privacy rights or if giving you access poses a serious threat to someone's life, health or safety). Please note that we may apply an administrative charge for providing access to your information in certain circumstances. Any such charge will be reasonable and we will advise you of the charge before providing you with access to your personal information. If this charge is relevant we will contact you to explain why. Please note that if you request a copy of your data using electronic means (such as email), then we will provide a copy of your information in electronic form unless you ask us to do otherwise.

Your rights to have your information corrected or deleted

You may challenge the accuracy or completeness of your personal information and have it corrected or completed, as applicable. If you have an account with us, you can sign into that account to update your personal information. If you have problems updating the information on your account or if you would like us to delete your information, please email your request to the address set out below and we will action it as soon as possible.

Your right to have your personal information deleted is subject to certain conditions. We may not be in a position to erase your personal information, if for example:

We are unable to verify your identity;
We need it to comply with a legal obligation;
We need it to exercise or defend legal claims;
We need it to exercise freedom of expression and information;
We need it to carry out a task in the “public interest”; or
We need it to archive personal information in the public interest, or for scientific, historical, or statistical research purposes if those purposes would be seriously impaired by the erasure of the personal information.

Your right to object to us processing your personal information

You have the right to object to us processing your personal information where we have explained that processing is necessary for our legitimate interests (for example, where the processing is necessary for the legitimate commercial objectives we pursue in the course of our business), including (but not only) the Profiling we undertake to send you personalised offers, product recommendations and similar content. If you do this, we will need to show either a compelling reason why our processing should continue, which overrides your interests, rights and freedoms or that the processing is necessary for us to establish, exercise or defend a legal claim (or in some circumstances we may obtain a consent from you to continue our processing).

Your rights in relation to automated individual decision-making including Profiling

You have the right to object to any results of a processing activity that prejudice your rights and that are conducted exclusively through automated systems. You have the right to obtain human intervention from our side. We do not do this type of Profiling activity at this time.

Rights in relation to direct marketing

You have the right to ask us to stop processing your personal information for direct marketing purposes including (but not only) any Profiling we undertake for the purposes of direct marketing. We will in any case only send you marketing communications if you have previously consented to this or if we can do this based on legitimate interests (see the table above for more details). If you change your mind you can easily unsubscribe from our marketing communications at any time by following the instructions included in these marketing communications. Alternatively contact us – see ‘Contacting Us’ below.

Please note that, if you have consented to receive offers from our partners, our partners are responsible for taking account of your rights, including your right to unsubscribe from receiving offers from them. Their contact details should be included in their own communications to you / in their own privacy policies.

Your right to have your personal information transmitted to another organisation

Where we hold personal information about you with your consent or for the performance of a contract with you, you also have the right to ask us to provide you with the personal information we hold about you in a structured, commonly used and machine-readable format and, where technically feasible, to transmit that personal information to another organisation.

If you exercise this right, please where possible specify the type of information you would like to receive (and where we should send it) so that we can ensure that our disclosure is in line with what you require. This right only applies if the processing is based on your consent or on our contract with you and when the processing is carried out by automated means (i.e. not within paper records). It covers only the personal information that has been provided to us by you.

Your right to make a complaint

You have the right to lodge a complaint with your local data protection authority in the European Economic Area (EEA) if you believe that we have not complied with applicable data protection laws. If you are based outside of the EEA there may be other applicable supervisory authorities/regulators in your country to which you have the right to complain.

The local data protection authority will differ depending on the country you are in. Please contact privacyoffice@jumeirah.com if you require assistance in identifying your relevant data protection authority.

For processing that is based on your consent, you have the right to withdraw that consent at any time. You can do this by contacting us using the details below. The consequence would be that we cannot send you some marketing communications (in cases where we rely on consent for those instead of relying on our legitimate interests – see the table above for more information).

If you do decide to withdraw your consent we will stop processing your personal information for that purpose, unless there is another lawful basis we need to rely on – in which case, we will let you know. Your withdrawal of your consent won’t impact any of our processing up to that point.

We will not send you our Newsletter if you withdraw the consent for that, unless you decide to re-subscribe.

Contacting us

If you want to exercise any of the rights set out above, have any questions or concerns about how we treat your personal information, you wish to ask us to stop processing your personal information, or you would like to request a copy of the personal information we hold about you, please contact us privacyoffice@jumeirah.com or by writing to us at:

Jumeirah Privacy Office
PO Box 73137
Dubai
United Arab Emirates

Please include your reply address when you write to us.

We have a data protection officer (DPO) and you can contact our DPO in this way.

How long do we keep your personal information?

Your personal information is stored by us and/or our Service Providers, strictly to the extent necessary for the performance of our obligations (this means obligations under the contract we have with you or with the business/your employer who made the booking for you) and strictly for the time necessary to achieve the purposes for which the information is collected, in accordance with applicable data protection laws. When we no longer need to use your information, we will remove it from our systems and records and/or take steps to properly anonymise it so that you can no longer be identified from it (unless we need to keep your information to comply with legal or regulatory obligations to which we are subject or where we need to retain it for the period during which claims can be brought under the contract).

Jumeriah group companies in other countries who are data controllers (independent from us) will maintain a local copy of your personal information when that is required by applicable laws or regulations.

Children

We do not target our website at children ie. individuals under 18 years of age. It is intended as a ‘read only’ website for children who visit it under parent/guardian supervision. For instance, children are welcome to look at the photographs on our website and the descriptions of our services with parent/guardian supervision. We do not wish to hold any personal information about children. If you are a child who is reading this Privacy Policy, you must not sign up for our Newsletter or submit any personal information about yourself to us.

Data anonymisation and use of aggregated information

Your personal information will sometimes be converted into statistical or aggregated data which cannot be used to re-identify you. It may then be used to produce statistical research and reports. This aggregated data may be shared by us with other companies in the Jumeirah group of companies.

Changes to this Privacy Policy

We will update this Privacy Policy if we need to do that in response to changing legal, regulatory or operational requirements. We will notify you of any such changes (including when they will take effect) if we are required to do so by data protection laws. Your continued use of our website and / or services after any such updates have been brought to your attention (for example by a banner on our website to say ‘we have updated our Privacy Policy – click here’) will be taken by us to mean that you have read the revised Privacy Policy. Please do not use Jumeirah’s website and services if you do not accept the changes. This does not mean we are asking you for a consent (under data protection law) to the changes. If we need any consents we will ask for those separately.