个人资料保护政策

这个人资料保护政策旨在说明惠勝酒店(马六甲)有限公司(本公司)在对于您的个人资料的处理政策，其中包括对于在收集，处理，揭晓以及维护您的个人资料方面的处理政策。

本公司承诺将保障您的个人资料。本公司十分明白您对于您个人资料的私隐与安全性事件上的顾虑。因此，我们承诺遵守在2013年11月15号生效的个人资料保护法令条例2010（Personal Data Protection Act 2010 “PDPA”），以及于2025年分阶段生效的《2024年个人资料保护（修正）法令》所引入的额外义务。以下透露我们对于资料，以及搜集与宣传的做法。

1. 个人资料保护政策的应用方式

这个人资料保护政策应用于任何形式的个人资料与咨询，不管是电子还是书写的形式下，只要是与我们有任何交流（商业交流）都受到此政策的约束。

此政策呈现以及显示我们在保障您个人资料事件上的承诺，而且我们所拥有，经营或管理的酒店与度假胜地产业也会遵守此政策（当中包括本公司与附属公司，联营公司）。“惠勝酒店”，“我们”(we)，“我们的”(our)，和“咀们”(us) 在以下的内容，将统称本公司与其附属公司或联营公司。

2. 我们搜集个人资料的方式

“个人资料”在这个人资料保护政策是指能辨认出您的个人咨询。您可在不提供任何个人资料与咨询的情形下游览我们的网站。每当我们需要收集您的个人资料以为您提供服务时，我们将询问您以能自愿性的提供我们有关资料。个人资料可根据以下目的而被搜集但不限于：

● 履行预订或要求咨询与服务；

● 优先顾虑您的个人喜好；

● 购买我们的产品或服务；

● 注册成为我们的会籍；

● 提交求职申请；和/或

● 促进沟通（“用意”）。

3. 我们搜集个人资料的类型

我们所处理的个人资料类型，包括但不限于：

● 您的名字，地址，联络资料，身份证/护照和签证（VISA)资料；

● 入住客人资料，包括您所寄住过的酒店，抵达和离开日期，所购买的产品和服务，提交过的特别要求，观察关于您的服务喜好，所拨达的电话号码和接收的传真与电话短讯；

● 您的信用卡资料，信用卡验证码，银行账户资料，电子邮件地址，档案与密码资料，飞行常客或旅行合伙的计划联系；

● 为满足特别要求而需要的任何资料（例如休闲，旅游和客人喜好）；

● 您对我们服务的评论和意见；

● 从cookie所获得的资料。（cookie是在我们的电脑里的小型文本文件，它能在您下一次访问本惠勝酒店网站时识别您的浏览器，除非您禁用cookies或以其他方式调整它们，或者禁用任何需要启动cookies的本公司服务；

● 我们的电脑系统被设计成自动收集资料，这行为将收集某些匿名数据好让我们了解惠勝酒店网站被网站游览者的使用模式以及如何能优化它。这自动化资料收集的编程所得到的资料包括您电脑的网际网路协议地址，浏览器类型，浏览器语言，访问的页面，前面或后面访问的站点，用户会话的长短，出入状态或条件；

● 经第三方社交媒体与通过我们的网站（如Facebook［面子书］/ Twitter［推特］）的共享信息将约束于他们的隐私政策的约束。您也可以在这第三方社交媒体网站修改您的隐私设置；

● 通过您与本公司注册而专门提供资料；

● 您在我们场所的闭路电视录影。

4. 我们对于资料安全的承诺与保证

为了维持您资料的准确性，防止未经授权的接驻以及确保您资料的正确处理法，我们已经在采取适当的措施以对您资料的安全有保障。这些措施将时常被审查和监测。正当我们尽一切所能来保护您的资料时，现实却没有完美的措施可以保证您的资料将不被盗取与误用。我们将不会对这事件负上任何责任。

5. 我们对于您的资料使用方法以及揭晓的准则

我们所搜集关于您的资料是为了要协助您更简单地接驻我们公司所提供的服务和产品。公司将会理智地致力于保障我们所搜集关于您的资料的机密性。我们不把储存于我们数据库的您的资料贩卖，出租，交易或长租给任何第三方。我们即将吐露任何搜集到关于您的资料假若：

● 资料公开给予我们的服务提供者，经纪／代理人或生意伙伴与跟我们生意有关联的一方；

● 在我们确信吐露是在法律或法规要求的情况下，与执法者或执法当局合作，或是在执行我们的使用条款／其它协议；或是为了保护我们的权利，产业，或确保公司，我们顾客的安全性。前述的包括为了避免欺诈保护和信用风险保障的目的而与其他公司交换资料；

● 在公司或基本上所有公司的资产被收购或合并的事件上，您的个人资料可受制于其他的隐私政策；

● 公司可与提公司做分析和开发的第三方立约。我们可分晓您的资料给予这第三方，如果它的用途是被用于公司所指定的服务以及同意将确保对于资料的机密处理。

我们可根据您的资料来寄出对您有兴趣的宣传题材。如果您不希望收到此等的题材，您可在电子邮件列表选择＞退订＞（”unsubscribe”）或是书信通知我们个人资料保障员（Personal Data Protection Officer），宣传题材的寄出将会终止。

6. 查阅及更正权利

您有权利咨询查阅及更正您在我们的档案里的个人资料（根据有关豁免的个人资料保护法令或其他相关法律）。我们将致力确保您的个人资料是准确及达到最新更新，然而您也有责任通知我们关于您个人资料的更改以确保其资料是准确与当前最新的。

您有权利于：

● 为了进行审核目的，要求查阅您在我们的档案里的个人资料；

● 倐若您发现您的资料不准确，拥有误导性，已过时或是在确认和验证新信息时发现资料不齐全，要求更正您的个人资料于我们的档案里；

● 咨询您的个人资料只限于此收集资料用途而储存；

● 与我们联系将您的个人资料用于宣传目的提出异议；和

● 在任何适用的法律限制约束，合同条件，在合理的时间之内，完全或部分撃消您的许可、准许或同意。

您可要求查阅或更正您的个人资料或限制处理程序，为此呈交您的书面要求于以下第11条所列的个人资料保护主任。

我们将保留对您个人资料查阅征收管理费用的权利，这数额是获得个人资料保护法令所准许的。至于对您查阅和/或更正您个人资料的权利，若法律不允许而此举涉及任何风险或涉及他人隐私的风险下，我们有权利拒绝查阅和/或更正您个人资料的请求。

7. 资料保存

任何我们所搜集的客户个人资料包括电子邮件地址将被储存与公司的数据库。公司既会采取所有相当以及必须的步骤以确保数据库的安全性和符合这私隐政策声明，与对未经授权的访问，更改，泄露，拆毁的事件上做出保障以防止此等事件的发生。

8. 个人资料选择性限制处理

您为我们所提供的个人资料这款项是出自于自愿的。倐若您不为我们提供您的个人资料，我们极有可能不能为您提供您所要求的服务、完成那用途以及与您沟通。

当您提供我们您的个人资料，你在此将被喻为允许我们根据这个政策处理您的个人资料。然而，如果您希望撃回或限制您的允许，请以书信立刻通知我们。

您有权利在于限制任何您在处理着的部分或全部个人资料，唯其原有用途除外。倐若您愿限制，请您即刻通知我们您的要求以及如何处理限制您的个人资料的细节。

您可在任何时刻更正或撃回您全部或部分所处理当中的许可/同意，只需在任何实用法律限制，合约义务之下以及位于以下第11条的细节与我们联系。请马上通知我们您的撃回或更改要求。

当您浏览本网站时，您的浏览次数或许会被记录 – 这是用于剖析用户数据浏览于我方网站时及一般使用形式。其中的记录过程资料将会是透过小型文字檔案（cookie文件）来收集。

若您不希望个人资料被小型文字檔案（cookies）纪录于网站，您可调整你的网络设置关闭或限制小型文字檔案(cookies),把您的浏览历史删除和清除浏览器缓存。

9. 链接第三者网站

某些网站可链接第三者网站。请注意惠勝酒店(马六甲)有限公司对于第三者在网站聚集，使用，维持，分享与披露任何资料和资讯不负上任何责任。如果您将您的个人资料提供给予第三者的网站，而这个人资料保护政策和服务条规于这些网站还生效，我们将不对此网站的个人资料传递、处理习惯或隐私政策负责任。

10. 拒绝/未能提供个人资料的后果

您所为我们所提供的资料是完全自愿的状态。然而，当您因拒绝/未能提供个人资料而造成以下的结果／情形，我们将不为此等事件发生而负上责任：

● a. 双方无法正式确定和/或进行有关协议或有关我们的产品和/或服务交易；

● b. 我们无法提供您所要求的信息，通知，服务和/或产品；

● c. 我们无法提供您最新的产品和/或展览通知和/或服务，并无法获得您对我们的产品和/或服务的反馈；

● d. 有关第三方无法代表我们给您提供产品和/或服务。

11. 委任个人资料保护主任

您可通过以下方式联系我们的个人资料保护主任：

个人资料保护官员 (Personal Data Protection Officer)
惠勝酒店(马六甲)有限公司 (Hatten Hotel (Melaka) Sdn Bhd)
F3-96, Hatten Square,
Jalan Merdeka, Bandar Hilir,
75000 Melaka.
电话: +606-286 9696
传真: +606-221 9799
电子邮件 : pdpa@hattenhotel.com

12. 个人资料外泄通知

倐若本公司有理由相信发生个人资料外泄事件，我们将尽快通知个人资料保护专员；若该外泄事件造成或可能造成受影响资料当事人重大损害，我们也将通知有关资料当事人，此举符合《2024年个人资料保护（修正）法令》的规定。本公司备有内部程序，以评估、遙止及记录个人资料外泄事件。

13. 资料不一致

倐若个人资料保护政策中当中的英语版本与华文和马来文版本之间资讯有不一致的情形下，我们将以英文版本的个人资料保护政策声明为准。

14. 第三方的同意／授权

在您提供第三方的个人资料（如您的紧急联络人，授权代表，租户，承包商，律师或财务顾问）致我们的场合下，我们信任及依赖您，也视您已为获得该第三方的同意让我们处理个人资料有关用途。

15. 个人资料保护政策更正

我们有可能随时未经通知您的情况下而需更改我们所采取的个人资料保护政策，以为了符合有关法律与条规的变动以及我们的生意业务或政策达成一致。所以，我们鼓励您能时刻查看我们的网站以便了解我们的个人资料保护政策。

English Version

This Personal Data Protection Policy (“PDPA Policy”) explains the manner in which your personal information collected from or provided by you is processed, disclosed and safeguarded by Hatten Hotel (Melaka) Sdn Bhd (“THE COMPANY”).

THE COMPANY is committed to ensuring your personal information is protected. THE COMPANY understands and appreciates that you are concerned about your privacy and about the confidentiality and security of information we may collect about you. We pledge to fully comply with the requirements of the Personal Data Protection Act 2010 (“PDPA”), which came into force on 15 November 2013, as well as the Personal Data Protection (Amendment) Act 2024, which introduced further obligations that took effect in stages during 2025. The following discloses our information gathering and dissemination practices.

1. The application of this PDPA Policy

This PDPA Policy applies to personal data and information in any form, whether electronic or written, regarding guests and other individuals who enter into a transaction with us.

This PDPA Policy conveys our commitment to protect your personal information and has been adopted by all the hotel and resort properties owned, managed and/or operated by THE COMPANY or its affiliated or associated companies. References to “Hatten Hotel”, “we”, “our” and “us” hereinafter, depending on the context, collectively refer to THE COMPANY or its affiliated or associated companies.

2. Our collection of personal information

The term “personal data” in this PDPA Policy refers to personal information which is capable of identifying you as an individual. You can visit our website without providing any personal data or information. When we need to collect personal data from you to provide you with a particular service, we will ask you to voluntarily supply us with the information we need. Personal data may be collected for purposes including but not limited to:

● Fulfilling reservations or requests for information or services;

● Accommodating your personal preferences;

● Purchasing our products or services;

● Registering for our programme memberships;

● Submitting job applications; and/or

● Facilitating communications (“the Purpose”).

3. Types of personal information we collect

The types of personal data that we process include but are not limited to:

● Your name and address, contact information, Identity Card/Passport and Visa information;

● Guest stay information, including the hotels where you have stayed, dates of arrival and departure, goods and services purchased, special requests made, observations about your service preferences, telephone numbers dialled and faxes and telephone messages received;

● Your credit card details, CVC number, bank account details, email address, profile or password details and any frequent flyer or travel partner programme affiliation;

● Any information necessary to fulfil special requests (for example, leisure, travel and guest preferences);

● Your reviews and opinions about our services;

● Information derived from cookies (small text files placed on our computer which uniquely identify your browser the next time you visit this Hatten Hotel Site), save where you disable cookies or otherwise manage them, or do not use any of THE COMPANY’s services which require cookies to be enabled;

● Information gathered automatically by our computer systems programmed to gather certain anonymous data to help us understand how this Hatten Hotel Site is being used and how we can improve it. This automatically gathered data includes your computer’s IP or “Internet Protocol” address, browser type, browser language, the pages visited, previous or subsequent sites visited, length of user sessions, access status or conditions;

● Information shared with third party social media websites and services through our site (such as Facebook/Twitter/Instagram) will be governed by their privacy policies. You may also be able to modify your privacy settings with these third party social media websites;

● Information that is gathered through registration that you specifically give THE COMPANY;

● CCTV recording of you on our premises.

4. Our commitment to data security

To maintain the accuracy of your personal data, as well as preventing unauthorised access to and ensuring the correct use of your personal data, we have carried out appropriate physical, electronic and managerial measures to safeguard and secure the personal data we collect. These measures are subject to ongoing review and monitoring. Whilst we make every effort to protect your personal data, no security measures can guarantee that your personal data and information will not be subject to interference, misuse or hacking, and we shall not be responsible for any loss, misuse or alteration arising as a result of such incidents.

5. How we use your information and whom we may disclose it to

The information that we collect about you is used to help you access the services or acquire the goods that THE COMPANY provides more easily. THE COMPANY will use reasonable endeavours to keep the information we collect from you confidential. We do not sell, rent, loan, trade or lease your personal data stored in our database to any third parties. We may disclose the personal information, other information or data we collect from you if:

● Disclosure of information is made to our service providers, agents or business partners and affiliates that we work with in connection with our business;

● We believe that disclosure is required under the law, to cooperate with regulators or law enforcement authorities, or to enforce our Terms of Use or other agreements, or to protect the rights, property or safety of THE COMPANY, our customers or others. The foregoing includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk protection;

● THE COMPANY or substantially all of its assets are acquired by or merged with another entity, in which case your personal information may become subject to a different privacy policy;

● THE COMPANY contracts with third parties who carry out analysis and development on our behalf; we may share your information with such a third party provided that it uses the information only to perform services as requested by THE COMPANY and agrees to keep the information strictly confidential.

We may also use your information to send you promotional material which you may find of interest. If you do not wish to receive such material, you may simply “unsubscribe” from our mailing lists or inform our Data Protection Officer in writing, and no further material will be sent to you.

6. Rights of access and correction

You have the right to request access to and correction of your Personal Data in our records (subject always to exemptions provided under the PDPA or other laws). We will make every endeavour to ensure that your personal information is accurate and up to date, but you are responsible for informing us of changes to your Personal Data and for ensuring that such information is accurate and current.

You have the right to:

● Request access to your Personal Data in our records for verification purposes;

● Request the correction of your Personal Data in our records in the event the information is inaccurate, misleading, out-of-date or incomplete, upon validation and verification of the new information;

● Request that your Personal Data be kept only for the fulfilment of the purpose for which it was collected;

● Communicate to us your objection to the use of your Personal Data for marketing purposes;

● Withdraw, in full or in part, your given consent, subject to any applicable legal restrictions, contractual conditions and a reasonable time;

You may request access to or correction of your Personal Data, or limit the processing thereof, by submitting a written request to the Data Protection Officer at the details set out in Section 11 below.

We reserve the right to impose a reasonable administrative fee for access to your Personal Data, as permitted under the Personal Data Protection Act. We also have the right to refuse a request to access and/or correct your Personal Data for reasons permitted under the law, such as where the expense of providing access is disproportionate to the risk to your or another person’s privacy.

7. Storage of data

Any personal information that we collect about customers, including email addresses, will be kept in a database of THE COMPANY. THE COMPANY will take all steps reasonably necessary to ensure that the database is treated securely and in accordance with this Policy, and to protect against unauthorised access to, or unauthorised alteration, disclosure or destruction of, data.

8. Choices to limit processing of personal data

The provision of your personal data to us is voluntary. If you do not provide your personal data to us, we may not be able to provide you with the services you require, may not be able to accomplish the Purpose, and may not be able to communicate with you.

By providing your personal data and information to us, you are deemed to have consented to us processing your personal data in the manner identified in this PDPA Policy. However, if you wish to withdraw or limit your consent, kindly notify us in writing immediately.

You have the right to limit, in part or wholly, any processing of your personal data other than for the Purpose it was initially given. If you wish to limit such processing, kindly inform us immediately of your request and how the processing of your personal data is to be limited.

You may at any time withdraw or amend, in full or in part, any processing consent previously given, subject always to any applicable legal restrictions or contractual conditions, by contacting the Data Protection Officer at the details in Section 11 below.

Your visit to our public website may be recorded for analysis of the number of visitors to the site and general usage patterns. Some of this information is gathered through the use of “cookies”. If you do not wish your Personal Data to be collected via cookies on the Websites, you may deactivate cookies by adjusting your internet browser settings, or by deleting your browsing history and clearing your browser cache.

9. Links to third party websites

The Websites may contain links to third party websites. Please note that THE COMPANY is not responsible for the collection, use, maintenance, sharing or disclosure of data and information by such third parties. If you provide information directly to such sites, the privacy policy and terms of service of those sites apply, and we are not responsible for the information handling practices or privacy policies of such sites.

10. Consequences of refusal/failure to provide personal data

The Personal Data provided to us is wholly voluntary in nature. However, should your refusal or failure to provide Personal Data result in any of the following, we shall not be held liable for any consequences arising therefrom:

● The inability of the parties to formalise and/or carry out the relevant agreement or transaction in relation to our products and/or services;

● Our inability to provide you with the information, notices, services and/or products requested;

● Our inability to update you with the latest promotions, products and/or services, and to obtain your feedback on our products and/or services;

● The inability of relevant third parties to provide products and/or services to you on our behalf.

11. Appointment of Data Protection Officer

You may contact our Data Protection Officer at:

Personal Data Protection Officer
Hatten Hotel (Melaka) Sdn Bhd
F3-96, Hatten Square,
Jalan Merdeka, Bandar Hilir,
75000 Melaka
Tel: +606 286 9696
Fax: +606 221 9799
Email: pdpa@hattenhotel.com

12. Data breach notification

In the event THE COMPANY has reason to believe that a personal data breach has occurred, we will notify the Personal Data Protection Commissioner as soon as practicable, and, where the breach causes or is likely to cause significant harm to affected data subjects, we will also notify those data subjects, in accordance with the Personal Data Protection (Amendment) Act 2024. THE COMPANY maintains internal procedures for assessing, containing and recording personal data breaches.

13. Inconsistency

This Policy is issued in the Bahasa Malaysia, English and Chinese languages. In the event of any inconsistency between these versions, the English language version shall prevail.

14. Third party consent

In the event you have provided personal data of third parties (for example your emergency contact person, authorised representative, tenant, contractor, lawyer or financial adviser) to us, we rely on you to have sufficiently obtained the prior consent of such third parties to allow us to process their personal data in relation to the Purpose, and you have advised them to read this Personal Data Protection Notice and Policy.

15. Changes to our Personal Data Protection Policy

We may, from time to time and without prior notice to you, be required to change this Personal Data Protection Policy to comply with, or remain consistent with, changes in applicable law and regulations, as well as our business operations or policies. We encourage you to check this Policy on our website from time to time.

个人资料保护政策