Privacy Policy
Last updated: February 2024
Mr & Mrs Smith: Privacy Policy Feb '24 (pdf) (English)
Introduction
Mr & Mrs smith (“MMS, we, us, our”) is a luxury hotel-booking website, headquartered in the United Kingdom.
Our website at https://www.mrandmrssmith.com and our mobile application (collectively, “platforms”) and other services enable adventurers to book global luxurious hotels and villas (“Hotels”) all over the world from the comfort of their computers.
The application of this policy
To provide the platforms and other services, we need to collect, use and share personal information . this policy explains how we use your personal information when you access and use the platforms or receive our other services.
This policy does not apply to the processing of your personal information by other members of the Hyatt Group outside of the platforms or our other services. For more information on how the Hyatt Group processes information, please see its privacy policy found here.
Local laws
While this policy is intended to describe the broadest range of our information collection, processing and sharing activities globally, some activities may be more limited in some jurisdictions based on the particular laws or regulations in those territories/countries. For example, the laws of a particular territory/country may limit the types of personal information we can collect or the manner in which we process that information. in those instances, we adjust our internal policies and/or practices to reflect the requirements of local law.
1. Types of personal information we may collect
The personal information we collect may vary by territory/country or by your preferred method of interaction with us. We obtain most of your personal information directly from you through the platforms or from other booking platforms which are authorised to connect you to the Hotels.
If you do not provide us with personal data, we may not be able to provide our services or meet our obligations to you.
The table below contains more details regarding the personal information we may collect and process about you.
|
Category |
Details |
Source |
|
Identification information |
|
|
|
Demographic information |
|
|
|
Contact information |
|
|
|
Stay information |
|
|
|
Travel club information |
|
|
|
Payment information |
|
|
|
Purchase history |
|
|
|
Preferences and inferences |
|
|
|
Correspondence |
|
|
|
Login details |
|
|
|
Social media platform information |
|
|
|
Other booking platform information |
|
|
|
Third-party information |
|
|
|
Website or mobile application data |
|
|
|
Consent records |
|
|
2. biometric, health-related or other sensitive personal information
There may be instances in which the personal information listed above contains information that is categorised as sensitive personal information under the privacy laws of some territories/ countries.
Special categories
Depending on the applicable law, sensitive personal information can mean personal information from which we can determine or infer an individual’s racial or ethnic origin, political opinions, religious beliefs or other beliefs of a similar nature, membership in a trade union or professional, religious, philosophical, or political association, physical or mental health or condition, medical treatment, genetic data, biometric information, information about an individual’s sexual orientation, personal information relating to potential crimes or international sanctions, or your precise geolocation.
We may collect sensitive personal information such as health-related or religion information you provide us to help fulfil special requests (i.e. health or religious conditions that require specific accommodation or services). For example, if you provide us with details of a physical disability for the purpose of your booking, we may pass such details on to your Hotel so that they can confirm appropriate or arrange appropriate access.
Financial information
In some rare instances, financial records, credit card information and location data may constitute sensitive personal information where you are located.
Use
We only process sensitive personal information in your jurisdiction if and to the extent permitted or required by applicable law (for example, (i) sanctions or anti-money laundering screening, (ii) to enable the Hotels to meet your needs, or (iii) to ensure we can process card payments).
Consent
Importantly, where we rely on consent to process your sensitive personal information, you have the right to withdraw that consent at any time.
3. How we use your personal information and our lawful reasons for that use
We use your personal information to provide you with the platforms and other services. To the extent permitted by applicable law, we also use your information for our wider business interests, such as planning, risk management and marketing. We describe that in more detail in the table below.
Lawful reasons for use
When we process your personal information as a user of the platforms or someone else with whom we do business, we process that information on the basis of one more of the following so called “legal bases” depending on the circumstances:
Contract
When you become a member of our travel club, make a booking through the platforms, or otherwise receive services from us, our main lawful basis for using your personal information is the performance of our contract with you.
Legitimate interests
If you are receiving services from us but someone else in your party or family contracted with us to make the booking, our lawful basis is our legitimate interest in administering your services.
Our main lawful basis for using your information for our wider business is the legitimate interests in providing, improving and developing the platforms and other services. We will only use your information for the purposes of a legitimate interest when there is no unfair impact on you.
Legal obligations
Where necessary, we will use your personal information to meet our tax and other legal obligations.
Sensitive personal information
Where we use your special category information or other information that is treated as sensitive personal information in a specific territory/country, we must identify an additional condition. this condition will mainly be that the use is necessary for compliance with the law or other substantial public interest. However, at times we may also rely on your consent. Where we rely on your consent, we will explain at the time what we need your information for and what we will do with it.
Purpose and lawful basis
The table below sets out in more detail how we use your information and our lawful bases.
|
Purpose / activity |
Information we use |
Lawful basis / condition |
|
Arranging and administering your stay at a Hotel |
|
|
|
Providing the platforms |
|
|
|
Taking payments |
|
|
|
Correspondence, feedback, market research and surveys |
|
|
|
Business planning, improvements and development |
|
|
|
Marketing, contests and sweepstakes |
|
|
|
Safety, cyber incident and crime prevention, prevention of harmful activities |
|
|
|
Tax and regulatory obligations on MMs and other third parties involved in providing the platforms and/or other services |
|
|
|
Management of our internal systems processes and our use of technology, including audits, testing and upgrading of systems |
all of the above |
|
4. Disclosures of your personal information
Our service providers
We may outsource the processing of certain functions or provision of services and/or information to third parties. When we do outsource the processing of your personal information to third parties or provide your personal information to third-party service providers, we oblige those third parties to protect your personal information with appropriate security measures.
Other booking platforms
We may disclose your personal information to other booking platforms (for example, Hyatt.com) which we may use to connect you to Hotels, in order to administer your stay at the relevant Hotel.
Reservations for Hotels
Our platforms and services allow you to book and make related requests to Hotels, which we do not own or operate. Where you book a Hotel or make a related request, we will pass information about you that you provide to us to the owner and/or operator of the Hotel. the information we provide to these third parties will be handled in accordance with their own privacy policies and procedures, and not MMs’.
Business transfers
In the unlikely event that we, or substantially all of our assets, are acquired, personal information collected about you, or control of such information, may be one of the transferred assets. in such case we may also transfer information to third party legal, technical or financial advisers as part of the relevant transaction.
Similarly, we may disclose your personal information to a third party whom we acquire in order to facilitate mergers and acquisitions of our business and for the furtherance of the purposes described above.
Regulators and official authorities
We reserve the right to disclose any personal information we have concerning you if we are compelled to do so by a court of law or lawfully requested to do so by a governmental entity or if we determine it is necessary or desirable to comply with the law or to protect or defend our rights or property in accordance with applicable laws.
MMs and Hyatt Group
We may disclose your information to other organisations within MMs and the Hyatt Group for the purposes described in this policy, including for providing you with our services, marketing analytics and for administering membership/loyalty programs.
Summary of Recipients
Further information about what information we share with service providers and third parties is included in the table below. please note that the table below contains personal information we may share where necessary on an occasional or one-off basis as well as personal information we share routinely. We will always minimise the amount of personal information shared wherever possible.
|
Service provider / Third party |
Purpose |
Information shared |
|
Hyatt Group |
How Hyatt uses your personal information is set out in the Hyatt privacy policies available here. |
|
|
Our service providers |
||
|
CRM providers |
|
|
|
Office and email software provider |
|
|
|
Payment processers |
|
|
|
Third-party data centres |
|
|
|
Third-party contact centre providers |
|
|
|
Other IT service providers |
|
|
|
External auditors |
|
|
|
External law firms |
|
|
|
Other booking platforms |
|
|
|
Third party marketing providers |
|
|
|
External accountants |
|
|
|
Independent third parties |
||
|
Hotels |
|
|
|
Social media platforms |
|
|
|
As part of business transfers |
|
|
|
Regulators and official authorities |
|
|
5. International transfers
Because of the international nature of our business, we will need to transfer your personal information to other territories/countries. these territories/countries may have different laws and data protection compliance requirements to those that apply in the country in which you are located.
For example, we will transfer your personal information to your Hotel. You can see the territories/countries where each Hotel is based on our website.
When we transfer your personal information to another country, we will ensure that country has been recognised as providing an adequate level of data protection or implement appropriate Eu approved standard contractual clauses safeguards (or, where applicable, appropriate clauses approved for use in other jurisdictions). Where we have not implemented an appropriate safeguard, we will identify an exemption, such as your consent or the contract for your stay at a Hotel.
Please contact us if you want further information on the specific mechanism used by us when transferring your personal information, using the relevant contact details provided in section 9 (Contact) below.
Intra-Group transfers
Where your personal information is shared between entities within the Hyatt Group, it will be transferred to the major locations in which Hyatt or Hyatt Locations (as defined by the Hyatt privacy policy) operate including the United States of America, Hong Kong and Germany (a full list of the locations where your information could be transferred can be found by selecting “all” here. In such cases, Hyatt has implemented binding corporate rules to protect personal information it transfers to other territories/countries. You can find out more about Hyatt’s binding corporate rules and international transfers here.
6. Retention
We will only retain your personal information (including your sensitive personal information) for as long as is reasonably necessary for the purpose for which information was collected, or as legally required.
Once the purpose for collecting your personal information has been achieved, we will delete your personal information. that is ten years after our last contact with you subject to: regulatory requirements that we are subject to, including laws and regulations related to tax, employment, accounting, and securities; whether a legal claim might be brought against us, for which the information would be relevant; the necessity of the information to provide the platforms and other services to our customers; and the types and sensitivity of personal information being processed (which might result in a shorter period).
7. Children
We do not sell products or services for purchase by children. You may only use our websites if you are at least 18 years of age and can form legally binding contracts under applicable law. We will only collect information relating to children with the specific permission of parents or guardians.
8. Your privacy rights and specific territories/countries
European Economic Area, Switzerland and United Kingdom
If you are based in the UK, European Economic Area or Switzerland, you have the right to:
- access your information
- object to the use of your information
- erasure of your information
- portability of your information to other organisations
- correct and update your information if it is inaccurate
- restrict our use of your information while any concerns you raise are resolved
- complain to your data protection authority
- withdraw your consent
To exercise these rights, please contact us using the relevant contact details provided in section 9 (Contact) below. please be sure to include your full name, address and telephone number and a copy of a document evidencing your identity (such as an iD card or passport) so we can ascertain your identity and whether we have any personal information regarding you, or in case we need to contact you to obtain any additional information we may require to make that determination. Where you make more than one request in quick succession, we may respond to your subsequent request by referring to our earlier response and only identifying any items that have changed materially.
Please be aware that these rights are not absolute and there are situations where they cannot be exercised or they are not relevant. You can find out more information about your rights on the website of your country’s data protection authority.
United States
Depending on the privacy laws in your state of residence, you may also be able to make some or all of the following requests with respect to your personal information:
- Access/Right to Know – You have the right to confirm whether we process personal information about you, and you can request that we disclose to you the categories of personal information collected about you (including sensitive personal information), the categories of sources from which the personal information is collected, the categories of personal information sold or disclosed, the business or commercial purpose for collecting and selling the personal information, the categories of third parties with whom we share the personal information, the specific pieces of personal information collected about you, and information about the logic involved in any automated decision-making processes used by us (if applicable), as well as a description of the likely outcome of the process with respect to you.
- Deletion – You can request that we delete your personal information that we maintain about you, subject to certain exceptions.
- Do Not sell or share My personal Information for Behavioral Advertising – You can request to opt out of the sale of your personal information and the sharing of your personal information for cross-context behavioral advertising.We use cookies and related technology for advertising purposes, which could constitute a “sale” or “sharing” of your personal information according to some privacy laws. if you would like to opt out of such cookie-based tracking for advertising purposes, you can update your cookie preferences on our websites by clicking on the cookie center link in the footer of the page you are viewing. additionally, you can opt out of certain uses of cookies for advertising purposes by visiting here.
Your opt-out of cookie-based tracking for advertising purposes is specific to the device, website, and browser you are using, and is deleted whenever you clear your browser’s cache. this means you need to adjust your cookie preferences on each website, device, and browser you use.
- Correct or update my personal information – You have the right to request that we correct, update, or modify the personal information we maintain about you. if you have an account, you can also update your profile information any time by visiting the account settings page within your account.
- Opt-out of automated Decision-Making – You have the right to request to opt-out of any profiling or automated decision-making, to the extent we engage in those processing activities.
- Limit the use of my sensitive personal information – if you are a California resident, in relation to any sensitive personal information identified below, you can request that we limit our use and sharing of such information only to those uses which are necessary to carry out our relationship with you (such as providing the platforms and other services, maintaining the quality of the platforms and other services, or protecting the same against illegal activity), or as otherwise allowed by relevant privacy laws.
as is the case for all consumers regardless of residency, we will not deny you access to the platforms or other services, nor charge you different prices, nor discriminate against you in any other manner in response to you exercising any of these rights.
Eligible individuals can request to exercise these rights by emailing or calling us using the contact information below or by clicking on the link in the footer of the page you are viewing:
- Email – [email protected]
- Phone – please click here to access a local phone number
We may deny certain requests, or fulfil a request only in part, based on our legal rights and obligations. For example, we may retain personal information as permitted by law, such as for tax or other record-keeping purposes, to maintain an active account, and to process transactions and facilitate user requests.
We will take reasonable steps to verify your identity prior to responding to your requests.the verification steps will vary depending on the sensitivity of the personal information, the nature of your request, and whether you have an account with us.
You may designate an authorized agent to make a request on your behalf. When submitting the request, please ensure the authorized agent is identified as an authorized agent and ensure the agent has the necessary information to complete the verification process.
For purposes of exercising these rights, please note the following additional details regarding how we collect and use your personal information as described in this policy:
- We may collect, and use for our business and commercial purposes, the following categories of personal information as set forth in applicable California law: identifiers; California customer records (such as birthdate, contact information, and payment information); characteristics of protected classifications under California or federal law (such as demographic information like age and gender); commercial information; biometric information; internet or other electronic network activity information; geolocation data; audio, electronic or visual information; sensitive personal information; and inferences. please see section 1 and section 2 above for more details about the information and sensitive information we collect.
- We use the above categories of personal information for the business and commercial purposes described in section 3 above.
- We collect personal information from the following categories of sources, as more fully described in section 1 above: directly from you, automatically from your devices, from other booking platforms, from our service providers, from social media, from our business partners and from our affiliates and parents.
- We may disclose each of these categories of personal information to the extent permitted by applicable law with the following categories of parties, as more fully described in section 4 above: affiliates and parents, service providers, business partners, advertising networks, data analytics providers, social media networks, other booking platforms, with entities for our legal compliance purposes, and with potential acquirers or creditors.
- We may “sell” or “share” the following categories of personal information: identifiers; California customer records; demographic information; commercial information; Website or mobile application data or other electronic network activity; geolocation data; and inferences. We sell and share this personal information with advertisers, advertising networks, and social networks. We do not knowingly sell or share the personal information of consumers under 16 years of age.
- We do not use or disclose sensitive personal information for purposes other than those specified under applicable California privacy regulations.
PRC
If you are based in the people’s Republic of China (for the purpose of the policy, excluding the Hong Kong special administrative Region, the Macau special administrative Region and Taiwan, the “PRC”), the personal information protection Law (PIPL) applies to the processing of your personal information. unless otherwise stated in the following paragraphs, the rules indicated in this PRC part apply in addition to and, where contradictions exist, replacement of other sections of the policy.
- Legal basis for processing
We will seek your consent or follow other applicable legal bases to process your personal information. in particular, we rely on your consent for the processing of your personal information for conducting direct marketing activities.
- Sensitive personal information
there may be instances in which the personal information that you provide to us or that we collect is considered sensitive personal information under the PIPL (for example, governmental identifiers and financial information). We only process sensitive personal information if and to the extent permitted or required by applicable laws, including after obtaining your separate consent if required. We will seek to protect such information rigorously using the security measures required by the applicable laws and, hence, your sensitive personal information should not be processed in a way that will result in negative implications to your personal rights (for example, harm to your reputation, physical or mental health, personal or property security).
- Sharing and International transfer
When necessary for the purposes described in the policy, subject to your consent where necessary, your personal information may be shared to third parties located within or outside of the PRC. We will only share personal information that is necessary for the purposes indicated in the section 2 and section 3 (above).
Please click here [a] for a full list of organisations to whom we transfer personal information and their respective contact details and details on what, how and why such organisations process your personal information.
If required by applicable laws, we will conduct a security assessment, and/or undergo a personal information protection certification or sign standard contracts for cross-border transmission of personal information and take necessary measures to ensure the overseas recipient’s personal information handling meets the relevant personal information protection standards under the PIPL.
- Your rights under the PIPL
You may have certain rights related to your personal information. these rights include access, rectification, erasure, restriction or object, withdrawal of consent, data portability, cancellation of account, right to request explanation.
To exercise these rights, please contact us using the relevant contact details provided in section 9 ( Contact ) below . To ensure security, we will process your request in a timely manner and within the required timeframe after verifying your identity. We may refuse the requests that are unreasonably repeated, require too many technical methods (for example, the development of new systems or fundamental changes to current practices), raise risks to rights and interests of others, or are very impractical.
Brazil
If you reside in Brazil or otherwise subject to the brazilian Federal Law nº 13.709/18 ( LGpD), you may also exercise the following rights when applicable:
- Withdraw consent – you have the right, when the basis for processing is consent, to withdraw the consent at any time, through an easy to use and free of charge procedure.
- Right to review of automated decision-making – you may request review of decisions taken solely on the basis of automated processing of your personal data which affects your interests, including decisions intended to define personal, professional, consumer or credit profile or aspects of your personality. You may also request clear and adequate information regarding the criteria and procedures used for an automated decision, subject to our commercial and industrial secrecy.
- Right to petition – You may petition with the brazilian regulatory authority as well as consumer protection entities regarding the processing of your personal data.
Brazilian residents can exercise these rights by emailing or calling us using the relevant contact details in section 9 (Contact) below.
Mexico
Rights
If you are based in Mexico or otherwise subject to the Mexican data protection laws (including thedata protection under Federal data protection Held by private parties act ( the act )), the data controller for the use, processing, and protection of your personal data will be the company with whom you have contracted our services. You can find the relevant contact details in section 9 (Contact) below.
As the owner of your personal data, you have the right to:
- access your information and learn how we use this information and the specific terms and conditions governing its use
- object to the use and sharing of your information
- opt-out of direct marketing
- erasure of your information from our database when you consider it is not being processed according to the applicable laws
- correct and update your information if it is inaccurate, outdated, or incomplete
Please be aware that these rights are not absolute and there are situations where they cannot be exercised or they are not relevant. You can find out more information about your rights on the website of the National institute of transparency, access to information and personal data protection.
Consent
If you are based in Mexico or otherwise subject to the Mexican data protection laws, where necessary you consent to MMs’s use of your personal information as described in this policy, unless you provide an express objection, by sending an email to [email protected]. Consent is not required for any processing that is necessary for a contract between you and MMs, or in respect of the matters referred to in article 10 of the act.
Where we rely on consent to process your personal information, you have the right to withdraw that consent. However, in certain cases, we may not be able to fulfil your request or immediately stop processing your information due to legal or tax obligations we are subject to. additionally, withdrawing your consent for certain purposes might result in our inability to provide the service you requested, or terminate the agreement we have with you. therefore, you may withdraw your consent or object to only those purposes that are not essential for performing the agreement we have with you or for complying with our obligations.
Your consent may be provided by agreeing to this policy, through a third party, in person or through any other reasonable means used by MMs.
By providing any third-party’s personal information to MMs, you confirm that you have provided the third party with a copy of this policy and where necessary have obtained their consent to any handling of their personal data by MMs.
The above is without prejudice to your ability to exercise your rights under the act.
Limit the use and disclosure of your information
You may limit the use and disclosure of your personal information by registering with:
- The public registry to avoid advertising, managed by the Federal Consumer protection agency (pROFECO), which prevents your data from being used to receive advertising or offers of goods and services. To do so, please visit the official website of the pROFECO; or
- Our exclusion list, which ensures that your personal information is not processed by us for marketing, advertising, or commercial purposes.
How to make a request
In order to (i) exercise any of your rights; (ii) withdraw your consent, and (iii) limit the use or disclosure of your personal information, or obtain more information about the procedure and requirements to do so, you must submit a request to our privacy Department using the relevant contact details provided in section 9 (Contact) below. Your request should include:
- Full name of the owner of the personal data;
- A description of the personal data related to your request;
- A specific reference to the right(s) you want to exercise, if applicable, or if you want to withdraw consent or limit the use or disclosure of your personal data; and
- Your address or other means for delivering our response to your request.
To verify your identity, please attach a copy of your official identification document to your request. if the request is submitted by a legal representative, you must provide proof of their authority to act on your behalf.
Please note that the team in charge of processing your request for exercising your rights or revoking consent will respond to your request within twenty (20) business days, starting from the date you submitted your request.
9. Contact
General
If you have any questions about this policy or would like to exercise any of your rights, please contact us by clicking on the link in the footer of the page you are viewing.
Alternatively, please contact us by email at [email protected], by phone (find your local number here), by submitting a form on our website or by post at the following address:
2nd Floor Nucleus House
2 Lower Mortlake Road
Richmond
TW9 2Ja
United Kingdom
Mexico
In order to exercise any of your rights set out in section 8 (above) or ask any queries you may have about this policy, you may contact us using the following contact details:
|
Smith Global Ltd |
2nd Floor Nucleus House 2 Lower Mortlake Road Richmond TW9 2Ja United Kingdom |
This policy may undergo modifications, changes, or updates resulting from new legal requirements, internal needs, improvements in our privacy practices, or other reasons. any changes made to this policy will be available on this website.
a53944595/0.1/22 Feb 2024